tiny-regex-c CVE-2026-11478

Exploitation requires local system access with at least a low-privilege user account (CVSS AV:L, PR:L) - there is no network-based attack path. The target application must embed the kokke tiny-regex-c library at or before commit f2632c6d9ed25272987471cdb8b70395c2460bdb, and must expose a code path where attacker-controlled data (either the pattern or the input string) is passed to the matchstar function in re.c. No special configuration, non-default feature flag, or elevated system privilege is required beyond local access. Exploitation is limited to availability impact only (VA:L); confidentiality and integrity are not exploitable through this vulnerability. Deployment in sandboxed, containerized, or capability-restricted environments (e.g., seccomp, cgroups CPU limits) would materially reduce the denial-of-service impact.

The CVSS 4.0 base score of 1.9 accurately reflects a tightly constrained threat: AV:L (local access required, no network exploitation path), PR:L (low-privilege attacker account needed), AC:L (no special conditions beyond access), and impact limited to VA:L (low availability degradation - not a full crash or system-wide DoS). Confidentiality and integrity are unaffected (VC:N/VI:N/SC:N/SI:N). The E:P exploit maturity modifier confirms PoC availability, consistent with the published archive. No EPSS score was provided in the input data, so exploitation probability cannot be quantified beyond the PoC signal. KEV status is negative - no confirmed active exploitation. The combination of local-only vector, low-privilege requirement, and low-severity impact makes this a low operational priority for most organizations; however, projects that embed tiny-regex-c and expose regex processing to local untrusted users (e.g., multi-tenant CLI tools, interpreters, or embedded systems with local user input) carry higher residual risk, compounded by the absence of any vendor patch.

A local attacker with a low-privilege account on a system running an application that embeds tiny-regex-c crafts a regex pattern and input string specifically designed to trigger worst-case backtracking in matchstar - for example, a pattern like (a+)+ against an input of repeated 'a' characters followed by a non-matching character. The application's processing thread spins consuming CPU, degrading or stalling the service for other users. The published proof-of-concept archive (tiny-regex-c-redos-poc.zip, referenced in the GitHub issue) provides a ready-made demonstration of this behavior.