https://seclists.org/oss-sec/2026/q4/289: CVE-2026-107891: musl libc: multiple integer overflow in gcomp, possibly leading to incorct allocation sizes and out-of-bounds heap writes
Affected Software
Frequently Asked Questions
Which applications are realistically exposed to this issue?
An application is vulnerable only if it passes regular expressions from an untrusted source to musl libc's regcomp function. The overflow conditions depend on the size and complexity of the regular expression itself, not on the input data being matched.
What could exploitation cause?
A predictable crash and denial of service are possible. Arbitrary code execution may also be possible depending on the application's heap object usage and concurrent execution.
Are typical regular-expression matches affected by untrusted input data?
Not solely because the data being matched is untrusted. The relevant risk is untrusted regular-expression patterns supplied to regcomp.
What can be done if an immediate patch or upgrade is not possible?
Prevent the application from processing regular expressions from untrusted sources. This removes the stated condition required for exposure.
Which musl libc versions are affected?
The vulnerable code has been present since musl libc 0.5.0. Versions through 1.2.6 are affected; users should apply the patch or upgrade to 1.2.7 when it becomes available.