{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-107891", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-10-09T04:31:18.665Z", "datePublished": "2026-11-05T15:16:05.511Z", "dateUpdated": "2026-11-05T16:09:17.753Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "musl", "vendor": "musl -libc", "versions": [{"lessThan": "1.2.7", "status": "affected", "version": "0.5.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-11-05T15:16:05.511Z"}, "references": [{"url": "https://musl.libc.org"}, {"url": "https://www.openwall.com/lists/musl/2026/10/21/1"}, {"url": "https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/21/18"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-05T16:09:17.753Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "musl", "vendor": "musl -libc", "versions": [{"lessThan": "1.2.7", "status": "affected", "version": "0.5.0", "versionType": "semver"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes."}], "id": "CVE-2026-107891", "lastModified": "2026-11-05T17:17:35.287", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "[email protected]", "type": "Secondary"}]}, "published": "2026-11-05T16:17:32.150", "references": [{"source": "[email protected]", "url": "https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941"}, {"source": "[email protected]", "url": "https://musl.libc.org"}, {"source": "[email protected]", "url": "https://www.openwall.com/lists/musl/2026/10/21/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/10/21/18"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "[email protected]", "type": "Secondary"}]}

{"bugzilla": {"description": "musl: musl: Arbitrary code execution via integer overflow in regcomp", "id": "2567542", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567542"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in musl. A remote attacker could achieve arbitrary code execution or cause a denial of service (DoS) by supplying a specially crafted regular expression to an application. Due to integer overflow vulnerabilities within the regcomp function, which compiles regular expressions, the library miscalculates memory allocation sizes. This flaw results in an out-of-bounds write to heap memory, which can lead to memory corruption or an application crash."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-107891", "public_date": "2026-11-05T15:16:05Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-107891\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-107891\nhttp://www.openwall.com/lists/oss-security/2026/10/21/18\nhttps://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941\nhttps://musl.libc.org\nhttps://www.openwall.com/lists/musl/2026/10/21/1"], "statement": "Red Hat rates this vulnerability as an Important security impact because successful exploitation allows unauthenticated remote attackers to trigger heap memory corruption, potentially leading to arbitrary code execution or service termination. Although this risk carries severe integrity and availability consequences, it is classified as Important rather than Critical due to high attack complexity requiring specific application handling of untrusted regular expression patterns. In standard Red Hat Enterprise Linux deployments, the system C runtime is provided by glibc rather than musl libc, meaning typical core installations are not exposed unless musl is explicitly deployed in specialized containers or standalone binaries.", "threat_severity": "Important"}

{"created": "2026-11-05T17:00:10.311568+00:00", "updated": "2026-11-06T14:00:07.359478+00:00", "vendors": []}