Rich Felker

Stories

musl libc discloses integer overflow in regex compiler affecting all versions

Disclosed CVE-2026-107891 and circulated the fix

On October 21, musl maintainer Rich Felker disclosed CVE-2026-107891: integer overflows in regcomp, the regular expression compiler in the compact C library that underpins Alpine Linux and most container images. The flaw has been present in every musl release since version 0.5.0 and can produce undersized heap allocations followed by out-of-bounds writes. At minimum it crashes programs; arbitrary code execution is possible depending on how the application uses the heap.

Updated Yesterday