CVE-2026-107891: musl libc: multiple integer overflow in gcomp, possibly leading to incorct allocation sizes and out-of-bounds heap writes
Published Oct 21, 2026
·Updated
[Unknown description]
Other sources
musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.
— MITRE
Affected Software
18 affected componentsFixes available
musl musl libc
ubuntu/musl*
ubuntu/musl*
ubuntu/musl*
ubuntu/musl*
ubuntu/musl*
ubuntu/musl*
ubuntu/musl*
ubuntu/musl*
debian/musl<=1.2.3-1, <=1.2.5-3.1~deb13u1
1.2.6-2
debian/musl*
debian/musl*
debian/musl<1.2.6-2
1.2.6-2
alpine/musl<1.2.5-r4
1.2.5-r4
alpine/musl<1.2.5-r12
1.2.5-r12
alpine/musl<1.2.5-r13
1.2.5-r13
alpine/musl<1.2.5-r24
1.2.5-r24
alpine/musl<1.2.6-r3
1.2.6-r3
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/muslto a version that resolves this vulnerability.Fixed in 1.2.6-2 - Upgrade
Upgrade
alpine/muslto a version that resolves this vulnerability.Fixed in 1.2.5-r4 - Upgrade
Upgrade
alpine/muslto a version that resolves this vulnerability.Fixed in 1.2.5-r12 - Upgrade
Upgrade
alpine/muslto a version that resolves this vulnerability.Fixed in 1.2.5-r13 - Upgrade
Upgrade
alpine/muslto a version that resolves this vulnerability.Fixed in 1.2.5-r24 - Upgrade
Upgrade
alpine/muslto a version that resolves this vulnerability.Fixed in 1.2.6-r3
Event History
Oct 28, 2026
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
Data Sourced
via Ubuntu·12:00 AM
RemedyDescriptionSeverityAffected Software
Nov 5, 2026
CVE Published
via MITRE·03:16 PM
Data Sourced
via MITRE·03:16 PM
DescriptionSeverityWeakness
Data Sourced
via OSV·03:16 PM
Weakness
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeakness