CVE-2026-107891
Description
A flaw was found in musl. A remote attacker could achieve arbitrary code execution or cause a denial of service (DoS) by supplying a specially crafted regular expression to an application. Due to integer overflow vulnerabilities within the regcomp function, which compiles regular expressions, the library miscalculates memory allocation sizes. This flaw results in an out-of-bounds write to heap memory, which can lead to memory corruption or an application crash.
Statement
Red Hat rates this vulnerability as an Important security impact because successful exploitation allows unauthenticated remote attackers to trigger heap memory corruption, potentially leading to arbitrary code execution or service termination. Although this risk carries severe integrity and availability consequences, it is classified as Important rather than Critical due to high attack complexity requiring specific application handling of untrusted regular expression patterns. In standard Red Hat Enterprise Linux deployments, the system C runtime is provided by glibc rather than musl libc, meaning typical core installations are not exposed unless musl is explicitly deployed in specialized containers or standalone binaries.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to eliminate untrusted regular expression compilation in applications linked against musl regcomp: upgrade to musl 1.2.7 (or the corresponding fixed Red Hat builds), which enforce an upfront input length limit, adjust the compilation stack size, replace xmalloc with xcalloc, and use check_add to detect integer overflows during expansion calculations, closing all 2 injection vectors (large regular expression string input, complex repetition constructs in regular expressions). Until patched, this is only a concern on Linux applications linked against musl libc that pass untrusted regular expressions to regcomp — Standard Red Hat Enterprise Linux core deployments running glibc are unaffected — so Prevent applications from accepting untrusted regular expressions or enforce strict length and repetition count limits before passing patterns to regcomp. As a compensating measure, Address Space Layout Randomization to randomize heap and library memory layout, Full RELRO and PIE to prevent overwriting Global Offset Table entries, Control Flow Integrity and Shadow Call Stack to block control-flow hijacking and ROP payload execution, SELinux enforcing mode to confine the compromised process within domain boundaries, Linux namespaces to isolate the process and bound access to the host network and filesystem, and Dropped POSIX capabilities to restrict privileges available if code execution occurs. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer overflow defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
