musl libc CVE-2026-107891

The application MUST compile attacker-controlled regular expressions through musl libc's regcomp(); the overflow is triggered by the size and complexity of the regex pattern itself, not by the subject data being matched. Exposure is limited to systems linking musl libc versions 0.5.0 through 1.2.6 (notably Alpine Linux, OpenWrt, and embedded builds). It is NOT exploitable where the application only compiles static or trusted regexes. The readily achievable outcome is a crash; reliable code execution further depends on application-specific heap layout and concurrent execution, which significantly limits escalation beyond DoS.

No CVSS, EPSS, KEV, or POC data is provided for this CVE, so quantitative exploitation signals are entirely absent - this must be weighed qualitatively. The advisory confirms only a reliable denial-of-service (predictable crash); arbitrary code execution is explicitly hedged as 'possible depending on the application,' not demonstrated, so it should not be treated as confirmed. The decisive risk gate is a narrow precondition: the vulnerability is reachable only when an application compiles regular expressions originating from an untrusted source via musl's regcomp - a design pattern that exists but is far from universal, which materially lowers real-world exposure despite musl's large deployment footprint. There is no public exploit identified at time of analysis and no evidence of active exploitation, so this is not a drop-everything emergency; however, musl's ubiquity in Alpine-based containers means the latent attack surface is broad wherever user-supplied regex compilation occurs. Net assessment: medium priority - patch through distro/base-image updates on a normal cadence, and prioritize any service that accepts externally-controlled regex patterns. Authentication requirements cannot be confirmed because no CVSS vector was supplied.

An attacker supplies a maliciously large or complex regular expression to an application feature that compiles untrusted patterns through musl's regcomp (for example a user-configurable search filter, log-matching rule, or WAF pattern). The crafted pattern triggers an integer overflow, producing an undersized heap allocation and an out-of-bounds heap write that reliably crashes the process, with potential for code execution depending on heap state and concurrency. No public proof-of-concept was identified at time of analysis.