Critical Integer Overflow Vulnerability Found in musl libc regcomp
A serious integer overflow flaw in the musl libc regcomp function allows for potential arbitrary code execution, affecting all versions from 0.5.0 through 1.2.6.
CVE-2026-107891 is a critical security vulnerability in the regcomp function of musl libc. Multiple integer overflows occur due to the complexity and size of processed regular expressions. This causes incorrect heap allocation sizes and out-of-bounds heap writes.
Applications using musl libc to compile regex patterns from untrusted inputs face serious security risks. The flaw triggers application crashes, denial-of-service, or arbitrary code execution. Severity depends on the heap layout and concurrent execution context. Because the vulnerability relies on the regular expression structure itself rather than matched data, systems accepting external regex patterns are vulnerable.
All versions from 0.5.0 through 1.2.6 are affected. Julien Voisin submitted the private report that triggered analysis by Szabolcs Nagy and Rich Felker. Their investigation uncovered repeating integer overflows in the regex compilation logic.
Patch.
You should upgrade to version 1.2.7 as soon as it becomes available. If you cannot patch immediately, you must validate and filter inputs to ensure only trusted sources supply regular expressions to regcomp.