CVE-2026-107891

musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple…

Risk score: 54/100
CVSS: 8.1 v3.1
Published: 5 Nov 2026

Open in the live forecast Today's forecast

What to know

What it is: musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.
Affected: See advisory
Fix: Upgrade the product to 1.2.7 or later.
Exploitation: No known exploitation

Why it is Yellow

CVSS 8.1 high
Remotely exploitable without logging in

References

https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941
https://musl.libc.org
https://www.openwall.com/lists/musl/2026/10/21/1
http://www.openwall.com/lists/oss-security/2026/10/21/18

Original description

musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.

Last activity 5 Nov 2026. Patch Forecast updates every hour.