CVE-2026-100290: Double free after allocation failure in regcomp and regexec
The regcomp and regexec functions in the GNU C Library version 2.3 to ...
Affected Software
Event History
Frequently Asked Questions
Which systems and processes are exposed?
Systems using GNU C Library versions 2.3 through 2.44 are affected across all supported architectures and ABIs. Exposure is relevant to processes that compile or execute regular expressions, particularly when they can receive patterns or subject strings from an attacker.
What conditions are required to trigger the failure?
A regular-expression operation must grow specific internal arrays, and a particular memory allocation must fail after earlier reallocations have succeeded. This makes the issue reachable primarily when the system is already under memory pressure; a crafted regular expression is not required.
What impact should be expected from attacker-controlled input?
An attacker supplying a pattern or subject string has little control over which allocation fails. The expected impact is a process crash rather than a reliable higher-impact outcome.