Post by @musl@social.treehouse.systems

@musl@social.treehouse.systems 15 hr. ago

SECURITY ADVISORY: musl libc up through 1.2.6 (present version) is affected by integer overflows in regcomp (regular expression handling) leading to insufficient allocation of heap-based buffers for the compiled regex data structures.

CVE-2026-107891 has been assigned for this issue.

https://www.openwall.com/lists/musl/2026/10/21/1

musl - CVE-2026-107891: musl libc: multiple integer overflow in regcomp,
possibly leading to incorrect allocation sizes and out-of-bounds heap writes

2 Boosts

0 Likes

Laurent Bercot

@ska@social.treehouse.systems 14 hr. ago

@musl I'm going to build new toolchains for gcc-15.3.0 and gcc-16.2.0. I'm not going to rebuild for the older ones. 🫩

Haelwenn /элвэн/ :triskell:

@lanodan@queer.hacktivis.me 14 hr. ago

@ska @musl Statically linked gcc?
(Otherwise it's just a rebuild of musl and statically-linked software that are using regcomp, right?)

musl libc

@musl@social.treehouse.systems 15 hr. ago

The patch in the advisory email adds checking for the overflows and also establishes improved early bounds intended to prevent the overflow conditions from being reachable in the first place.

musl libc

@musl@social.treehouse.systems 15 hr. ago

As an issue that can lead to writes outside of an allocated object, overflowing into other objects on the heap, CVE-2026-107891 should be taken with appropriate seriousness.

However, as far as we know at this time, without concurrent accesses from another thread to objects which might be stomped during regcomp, or unsafe SIGSEGV handler code, a predictable crash should happen before any further code runs that could use the clobbered objects in a way yielding control over the flow of execution to an attacker.

musl libc

@musl@social.treehouse.systems 15 hr. ago

Programs which might pass attacker-controlled regular expressions to the libc regcomp function are affected.

Programs not using these interfaces are not affected.