What’s Vulnerable › Vulnerabilities

CVE-2019-7309

• Severity: medium (CVSS 5.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-02-03 · updated 2026-10-14

Description

In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.

Affected products

• GNU C Library (glibc): through 2.29

References

• http://www.securityfocus.com/bid/106835
• https://security.gentoo.org/glsa/202006-04
• https://sourceware.org/bugzilla/show_bug.cgi?id=24155
• https://sourceware.org/ml/libc-alpha/2019-02/msg00041.html
• http://www.securityfocus.com/bid/106835
• https://security.gentoo.org/glsa/202006-04
• https://sourceware.org/bugzilla/show_bug.cgi?id=24155
• https://sourceware.org/ml/libc-alpha/2019-02/msg00041.html
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Get alerted when CVE-2019-7309 or the next vulnerability affects your stack