ALPINE-CVE-2026-107891: Integer Overflow
musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/muslto a version that resolves this vulnerability.Fixed in 1.2.5-r4 - Upgrade
Upgrade
alpine/muslto a version that resolves this vulnerability.Fixed in 1.2.5-r12 - Upgrade
Upgrade
alpine/muslto a version that resolves this vulnerability.Fixed in 1.2.5-r13 - Upgrade
Upgrade
alpine/muslto a version that resolves this vulnerability.Fixed in 1.2.5-r24 - Upgrade
Upgrade
alpine/muslto a version that resolves this vulnerability.Fixed in 1.2.6-r3
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Deployments using musl libc versions before 1.2.7 should be reviewed, particularly where application code passes regular expressions from untrusted sources to regcomp.
What level of attacker control is needed?
An attacker needs to influence a regular expression that is treated as untrusted and compiled through regcomp.
What is the potential security impact?
The integer overflows can cause incorrect allocation sizes and may result in out-of-bounds heap writes.