Calling NSS-backed functions that support caching via nscd may trigger the nscd client to call the memcmp function on data that is concurrently modified by other threads. In glibc 2.36, an optimized x86_64 memcmp implementation was introduced that is not safe against this undefined behaviour, leading to a crash of the nscd client and any application that uses it. This results in a denial‑of‑service condition where the affected service or application becomes unavailable until a restart or patch, but does not directly compromise confidentiality or integrity.

The GNU C Library (glibc) versions 2.36 and, due to backporting, 2.35 are affected. Any x86_64 system running these releases with the nscd caching feature enabled is vulnerable. The issue does not appear in earlier releases that lack the SSE2-optimized memcmp.

The CVSS score is 6.2, indicating moderate severity; the EPSS score is below 1 %, implying a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or through normal application use under high nscd load, not remotely exploitable. As such, the overall risk is moderate, mainly as a crash or service interruption if left unpatched.