What’s Vulnerable › Vulnerabilities
CVE-2025-5702
- Severity: medium (CVSS 5.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-06-05 · updated 2026-06-17
- Weakness: CWE-665
Description
The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.
Affected products
- GNU C Library (glibc): from 2.39 before 2.39-209; from 2.40 before 2.40-139; from 2.41 before 2.41-60 — fixed in 2.39-209, 2.40-139, 2.41-60
How to fix
Upgrade to a fixed version: GNU C Library (glibc) 2.39-209, 2.40-139, 2.41-60. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-5702 or the next vulnerability affects your stack