{"id":"CVE-2026-107891","title":"musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.","summary":"musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-190"],"vendor":"musl -libc","product":"musl","affected":["musl >= 0.5.0 < 1.2.7"],"published":"2026-11-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T16:09:17.753Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107891","references":[{"url":"https://musl.libc.org"},{"url":"https://www.openwall.com/lists/musl/2026/10/21/1"},{"url":"https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T22:38:31.332Z","slug":"CVE-2026-107891","body":"## Overview\n\nmusl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.\n\n## Affected\n\n- `musl >= 0.5.0 < 1.2.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}