{"id":"CVE-2026-107891","kind":"vulnerability","aliases":["CVE-2026-107891"],"related":[],"title":"musl libc: regcomp integer overflows allow out-of-bounds heap writes","description":"musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.","summary":"musl libc before 1.2.7 has multiple integer overflows in regcomp when an untrusted regular expression is compiled, which can produce incorrect allocation sizes. The resulting out-of-bounds heap writes could let an attacker corrupt memory and potentially run code in the affected program.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["alpine","c","containers","musl","runtime"],"not_affected_if":["fixed-regex-patterns","glibc-systems"],"how_to_check":"- Run `ldd --version` or check the musl version of the system (`/lib/ld-musl-*.so.1`) and compare it against `1.2.7`.\n- Find programs that compile user-supplied regular expressions with `regcomp` on Alpine or other musl-based systems.","fix":"- musl libc: upgrade to `1.2.7` or later.","status":"open","published_at":"2026-11-05T16:17:32+00:00","first_seen_at":"2026-11-05T16:40:01+00:00","triaged_at":"2026-11-05T16:41:24+00:00","updated_at":"2026-11-05T16:41:24+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-05T16:41:24Z","model":"claude-haiku-5-5","output":{"fix":"- musl libc: upgrade to `1.2.7` or later.","reach":"unknown","title":"musl libc: regcomp integer overflows allow out-of-bounds heap writes","impact":"high","summary":"musl libc before 1.2.7 has multiple integer overflows in regcomp when an untrusted regular expression is compiled, which can produce incorrect allocation sizes. The resulting out-of-bounds heap writes could let an attacker corrupt memory and potentially run code in the affected program.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["musl","alpine","containers","c"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker corrupts heap memory, possibly running code","analyst_note":"Check the NVD entry and the linked discussion for which regex features trigger the overflows and whether a patch commit exists.","how_to_check":"- Run `ldd --version` or check the musl version of the system (`/lib/ld-musl-*.so.1`) and compare it against `1.2.7`.\n- Find programs that compile user-supplied regular expressions with `regcomp` on Alpine or other musl-based systems.","plain_action":"","needs_analyst":true,"not_affected_if":["glibc-systems","fixed-regex-patterns"],"who_is_affected":"Systems running musl libc older than 1.2.7 (common in Alpine Linux and container images) that pass untrusted regular expressions to regcomp. Applications that only compile fixed, developer-written patterns are much less exposed. unknown whether the sources name specific downstream packages.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000722,"input_tokens":4238,"output_tokens":597,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107891':15A,18A '-2026':14A,17A '1.2.7':27B,72C 'affect':67B 'alloc':45B,90C 'allow':6A 'alpin':19B 'attack':58B 'bound':10A,52B,96C 'c':20B 'code':64B 'compil':40B 'contain':21B 'corrupt':59B 'could':55B 'cve':13A,16A 'express':38B,77C 'heap':11A,53B,97C 'incorrect':44B,89C 'integ':4A,30B,84C 'lead':87C 'let':56B 'libc':2A,25B,70C 'memori':60B 'multipl':29B,83C 'musl':1A,22B,24B,69C 'out-of-bound':7A,49B,93C 'overflow':5A,31B,85C 'possibl':86C 'potenti':62B 'produc':43B 'program':68B 'regcomp':3A,33B,81C 'regular':37B,76C 'result':48B 'run':63B 'runtim':23B 'size':46B,91C 'untrust':36B,75C 'use':79C 'write':12A,54B,98C","nicknames":[],"mitigations":[],"who_affected":"Systems running musl libc older than 1.2.7 (common in Alpine Linux and container images) that pass untrusted regular expressions to regcomp. Applications that only compile fixed, developer-written patterns are much less exposed. unknown whether the sources name specific downstream packages.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["alpine","c","containers","high","musl","runtime"],"campaign_type":null,"first_public_at":"2026-10-25T10:36:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107891","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107891","severity":null,"published_at":"2026-11-05T16:17:32+00:00","modified_at":"2026-11-05T16:17:32+00:00","first_seen_at":"2026-11-05T16:40:01+00:00","fetched_at":"2026-11-05T16:40:01+00:00","note":null}],"documents":[{"id":3472,"url":"https://news.ycombinator.com/item?id=50230132","title":"CVE-2026-107891: musl Libc Integer Overflow in regcomp Leading to Heap Issues","kind":"post","source":"hackernews","publisher":null,"text":"CVE-2026-107891: musl Libc Integer Overflow in regcomp Leading to Heap Issues\nhttps://www.openwall.com/lists/oss-security/2026/10/21/18\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-25T10:36:18+00:00","relation":"discussion","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}