Integer overflows in musl libc's regcomp risk out-of-bounds heap writes

The musl libc developers have disclosed CVE-2026-107891, a vulnerability in regcomp, the function that compiles regular expressions. The code contains multiple integer overflow issues that can cause the library to allocate a buffer of the wrong size and, in turn, write past the end of a heap allocation.

What triggers the fault

The crucial detail is that the overflow conditions depend on the size and complexity of the regular expression passed to regcomp, not on the data being matched. In other words, the applications at risk are those that accept regular expressions from an untrusted source and compile them through the libc function.

How bad it is

The minimum impact is denial of service in the form of a predictable crash. But, as the advisory notes, depending on how an application uses heap objects and whether it runs concurrently, arbitrary code execution may be possible.

Who is affected

The vulnerable code has been present in musl since version 0.5.0, and every subsequent release up to and including 1.2.6 is affected.

What to do

The developers recommend applying the patch attached to the mailing-list message, or upgrading to version 1.2.7 once it is released. Where patching is not an option, they advise taking steps to keep regular expressions from untrusted sources out of the processing path entirely.

The first of the bugs was reported privately by Julien Voisin. Follow-up analysis by Szabolcs Nagy and Rich Felker uncovered a whole pattern of similar overflows.

Source: Lobsters