# CVE-2026-107891

Integer overflows in musl regcomp cause heap OOB writes

- Page: https://www.vulneraibility.com/cve/CVE-2026-107891
- CVSS: 8.1
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-190
- Published: 2026-11-05

## Affected versions

- musl -libc musl: affected >= 0.5.0 and < 1.2.7

A version outside these ranges is not a statement that it is unaffected.

## Impact

Integer overflows in regcomp lead to incorrect allocations and heap out-of-bounds writes, enabling crashes or potential arbitrary code execution if attacker-controlled regex is compiled.

## Action

Patch when possible

## Recommendation

Upgrade to musl 1.2.7, rebuild and redeploy affected binaries/images

## References

- [other] https://musl.libc.org
- [other] https://www.openwall.com/lists/musl/2026/10/21/1
- [other] https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941
- [other] http://www.openwall.com/lists/oss-security/2026/10/21/18

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.