Is CVE-2026-3904 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3904 being exploited in the wild.

How severe is CVE-2026-3904?

Medium severity, with a CVSS score of 6.2, published 11 March 2026.

Which products and versions are affected?

Gnu Glibc 2.35, 2.36; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 before V3.1.6.

Is there a fix for CVE-2026-3904?

A patch was published on 2026-03-11: Fixes backported to vulnerable branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-3904 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-3904?

Check whether you run Gnu Glibc or Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3904: GNU glibc race condition crash in nscd client via memcmp

CVE-2026-3904 · Severity: medium · CVSS 6.2 · Published 2026-03-11

A vulnerability in the standard C library (glibc) used by many Linux-based systems can cause applications to crash under high load. This occurs when the system's name service cache (nscd) attempts to compare data that is being simultaneously modified by another process. An exploit could lead to a denial-of-service condition, impacting the availability of critical services and applications on the affected system.

Technologies: Gnu Glibc, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Gnu, Siemens.

Quick answers

Is CVE-2026-3904 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3904 being exploited in the wild.
How severe is CVE-2026-3904?: Medium severity, with a CVSS score of 6.2, published 11 March 2026.
Which products and versions are affected?: Gnu Glibc 2.35, 2.36; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 before V3.1.6.
Is there a fix for CVE-2026-3904?: A patch was published on 2026-03-11: Fixes backported to vulnerable branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3904 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-3904?: Check whether you run Gnu Glibc or Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A race condition exists in the nscd (Name Service Cache Daemon) client-side code within glibc. When NSS-backed functions are called under high load on x86_64 systems, the client may invoke an optimized SSE2 implementation of memcmp on memory regions that are being concurrently modified by other threads or processes. While such concurrent modification is generally undefined behavior, the specific SSE2 optimization introduced in glibc 2.36 (and backported to 2.35) fails to handle the resulting inconsistent state, leading to a segmentation fault (SIGSEGV). This results in a crash of the nscd client and the calling application. The issue has been patched in glibc versions 2.37, 2.36-84, and 2.35-230.

Affected products

GNU glibc 2.35, 2.36
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 before V3.1.6

Timeline

2022-12-07: disclosed: Bug reported to GNU C Library bugzilla
2026-03-11: advisory: GLIBC-SA-2026-0004 published
2026-03-11: patched: Fixes backported to vulnerable branches

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.