musl libc regcomp integer overflows may cause heap writes
October 21: Rich Felker’s report restates the regcomp overflows; no patch or exploitation status is given.
CVE-2026-107891 in musl libc regcomp can cause wrong allocations and possible heap writes; no fix or exploitation is stated.
Rich Felker reported CVE-2026-107891 in musl libc. Multiple integer overflows in regcomp can produce incorrectly sized allocations and possibly out-of-bounds heap writes. Overflow conditions depend on the size and complexity of the regular expression passed to regcomp. The reports do not state a fixed release or known exploitation.
- CVE-2026-107891 affects musl libc regcomp.
- Overflows can yield incorrectly sized allocations.
- Out-of-bounds heap writes are described as possible.
- Trigger depends on regular-expression size and complexity.
- No fixed release or known exploitation is stated.
Timeline
dated events in the reporting · oldest first- Oct 21, 2026Rich Felker reports CVE-2026-107891 in musl libc regcomp. · oss-security
What each outlet adds
beyond the shared facts- oss-securityNames Rich Felker and ties overflow to regex size and complexity.
- LobstersConfirms versions, a patch, and exploitation status were unavailable.
- CVEs
- CVE-2026-107891
Coverage
oldest first · one row per article · UTC- · 4d ago
oss-securityFirst report
musl libc regcomp overflows can cause heap writes (CVE-2026-107891)
Overflow conditions depend on the size and complexity of the regular expression passed to regcomp.
- · 4d ago
Lobsters · security
musl libc regcomp integer overflows may cause heap out-of-bounds writes
CVE-2026-107891 covers multiple overflows that can yield wrong allocation sizes; no fix is stated.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-107891 | — | — | — |