Medium severity · published Jun 5, 2025
CVE-2025-5745
The strncmp implementation optimized for the Power10 processor in the GNU C Library version 2.40 and later writes to vector registers v20 to v31 without saving contents from the…
5.6
CVSS
0.3%
EPSS
No
On KEV
Description
The strncmp implementation optimized for the Power10 processor in the GNU C Library version 2.40 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GL
glibc · The GNU C Library
2.40 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-5745
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-5745
Issue Tracking
https://sourceware.org/bugzilla/show_bug.cgi?id=33060
More from glibc
9.8
CVE-2026-5450
scanf %mc off-by-one heap buffer overflow
8.4
CVE-2026-0861
Integer overflow in memalign leads to heap corruption
8.1
CVE-2024-33599
nscd: Stack-based buffer overflow in netgroup cache
7.8
CVE-2025-4802
Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in…
7.7
CVE-2026-19499
Buffer overflow in strfmon and strfmon_l right-justification padding
