AETERNAE AI RESEARCH LLC INDEPENDENT RESEARCH
ÆAETERNAERESEARCH
Sign inRequest access
← CVE index
Δ / VULNERABILITY RECORD

CVE-2026-3904.

Source-reported disclosure and enrichment record.

SEVERITY / CVSSMEDIUM / 6.2No severity score in this snapshot.
EXPLOITATION STATUSNot listed in the cached KEV catalogThis does not establish absence of exploitation.
RECORD STATUSMicrosoft vendor recordModified Mar 26, 2026

Disclosure summary

Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library version 2.36 under high load on x86_64 systems, the client may call memcmp on inputs that are concurrently modified by other processes or threads and crash. The nscd client in the GNU C Library uses the memcmp function with inputs that may be concurrently modified by another thread, potentially resulting in spurious cache misses, which in itself is not a security issue. However in the GNU C Library version 2.36 an optimized implementation of memcmp was introduced for x86_64 which could crash when invoked with such undefined behaviour, turning this into a potential crash of t

Source-reported weakness categories

CWE-366

Source-specific records & product guidance

Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.

Microsoft Security Updates (CVRF) · 2026-Mar

Open original source · Updated Mar 26, 2026

Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library version 2.36 under high load on x86_64 systems, the client may call memcmp on inputs that are concurrently modified by other processes or threads and crash. The nscd client in the GNU C Library uses the memcmp function with inputs that may be concurrently modified by another thread, potentially resulting in spurious cache misses, which in itself is not a security issue. However in the GNU C Library version 2.36 an optimized implementation of memcmp was introduced for x86_64 which could crash when invoked with such undefined behaviour, turning this into a potential crash of t

Maximum of vendor-reported product scores; products and fixed builds are associations, not a universal affected-version statement.

Microsoft maximum product score: 6.2

VendorProduct / associationVersion / bounds
Microsoft update guidecbl2 glibc 2.35-10 on CBL Mariner 2.0 (MSRC status code 3)

Original records & references

PUBLISHED 2026-03-12T21:03:00-04:00
MODIFIED 2026-03-26T21:38:14-04:00
INGESTED 2026-10-08T12:45:11-04:00