---
id: CVE-2019-7309
title: >-
  In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function
  for the x32 architecture can incorrectly return zero (indicating that the
  inputs are equal) because the RDX most significant bit is mishandled.
summary: >-
  In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function
  for the x32 architecture can incorrectly return zero (indicating that the
  inputs are equal) because the RDX most significant bit is mishandled.
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
vendor: gnu
product: glibc
affected:
  - glibc <= 2.29
published: '2019-02-03'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T07:16:56.607'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-7309'
references:
  - url: 'http://www.securityfocus.com/bid/106835'
    label: cve@mitre.org
  - url: 'https://security.gentoo.org/glsa/202006-04'
    label: cve@mitre.org
  - url: 'https://sourceware.org/bugzilla/show_bug.cgi?id=24155'
    label: cve@mitre.org
  - url: 'https://sourceware.org/ml/libc-alpha/2019-02/msg00041.html'
    label: cve@mitre.org
  - url: 'http://www.securityfocus.com/bid/106835'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.gentoo.org/glsa/202006-04'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://sourceware.org/bugzilla/show_bug.cgi?id=24155'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://sourceware.org/ml/libc-alpha/2019-02/msg00041.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-7309.json
  - url: 'https://access.redhat.com/security/cve/CVE-2019-7309'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1672232'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2019-7309'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2019-7309'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00607
epssPercentile: 0.47645
ingestedAt: '2026-10-14T07:21:04.806Z'
cwe:
  - CWE-393
scores:
  nvd: 5.5
  vendor: 3.3
---

## Overview

In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.

## Affected

- `glibc <= 2.29`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · updated 2026-10-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-7309.json)