EUVD-2026-21496Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCreate application using musl libc
-
ExploitTrigger qsort with >7 million array elements
-
ExecutionCorrupt stack via double-word primitives
-
ImpactExecute arbitrary code with elevated privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Always-incorrect control flow
|
| Exploitation Conditions | Local attacker or application must call qsort() on arrays exceeding ~7 million elements on 32-bit systems or ~64-bit Leonardo numbers on 64-bit systems. Affected: musl libc 0.7.10–1.2.6. No remote exploitation; requires local process execution or vulnerable application logic. |
| Impact | CVSS 8.1 reflects severe impact (confidentiality, integrity, availability) via local unauthenticated access on high-complexity conditions. Practical blast radius is constrained: exploitation requires sorting arrays exceeding ~7 million elements, a rare workload. musl adoption in embedded/container environments (Alpine Linux) elevates priority despite steep activation threshold. Moderate observed exploitation activity signals real-world interest despite impractical prerequisites. |
| Exploit ScenarioDerived | Attacker with local system access crafts application invoking qsort() on artificially inflated dataset (>7M elements), triggering stack corruption in musl's double-word primitives. Overflow overwrites stack canaries and return addresses, achieving arbitrary code execution. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Stack-based buffer overflow in musl libc 0.7.10 through 1.2.6 allows local attackers with high complexity requirements to corrupt memory during qsort operations on exceptionally large arrays (exceeding ~7 million elements on 32-bit systems, corresponding to the 32nd Leonardo number). Exploitation requires sorting arrays approaching billion-element scale on 64-bit platforms. Vulnerability stems from incorrect double-word primitive implementation in smoothsort algorithm. Successful exploitation enables arbitrary code execution with scope change, impacting confidentiality, integrity, and availability. No public exploit identified at time of analysis.
RemediationAI
Monitor musl libc project release page (https://musl.libc.org/releases.html) for patched versions addressing this qsort vulnerability. Vendor-released patch status pending independent confirmation at time of analysis; refer to upstream announcements via https://www.openwall.com/lists/oss-security/2026/04/10/13 for technical details and patch timeline. Interim mitigation: implement application-layer input validation to prevent qsort calls on arrays exceeding 7 million elements, or substitute alternative sorting implementations for large datasets. Organizations using Alpine Linux or containerized musl-based images should prioritize tracking vendor security advisories and apply updates immediately upon availability. High attack complexity (AC:H) reduces immediate risk, but scope change (S:C) warrants urgent attention for multi-tenant environments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause lies in flawed double-word primitive operations within musl's smoothsort qsort implementation (CWE-670). Triggers only when array size exceeds Leonardo number thresholds: 32nd Leonardo (~7M elements, 32-bit) or 64th Leonardo (impractical scale, 64-bit). Stack corruption occurs through improper boundary handling in heap construction phase.
Know when Musl gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
DescriptionCVE.org
An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements must exceed about seven million, i.e., the 32nd Leonardo number on 32-bit platforms (or the 64th Leonardo number on 64-bit platforms, which is not practical).
Executive ViewAI
CVE-2026-40200 is a stack-based buffer overflow in musl libc affecting versions 0.7.10 through 1.2.6 that could enable local attackers to execute arbitrary code through the qsort function when processing exceptionally large arrays. Organizations running musl-based systems-particularly embedded Linux, Alpine Linux containers, and lightweight distributions-should assess deployment scope, though real-world exploitation is constrained by the extreme array-size threshold required. This vulnerability poses a code execution risk in multi-tenant or untrusted-user environments.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict local user account access and enforce principle of least privilege to limit attacker capability; (2) Implement application-level input validation to prevent processing of exceptionally large arrays; (3) Use gVisor, seccomp, or AppArmor to sandbox applications performing qsort operations; (4) Monitor for unusual memory allocation patterns and process crashes in musl-linked binaries; (5) Prioritize upgrading to patched musl libc version upon vendor release. Monitor musl project repository and security advisories for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. Rate
Multiple integer overflows in the TRE library and musl libc allow attackers to cause memory corruption via a large numbe
Stack-based buffer overflow in the inet_pton function in network/inet_pton.c in musl libc 0.9.15 through 1.0.4, and 1.1.
musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv
Stack-based buffer overflow in fprintf in musl before 0.8.8 and earlier allows context-dependent attackers to cause a de
musl libc before 1.1.17 has a buffer overflow via crafted DNS replies because dns_parse_callback in network/lookup_name.
In musl libc through 1.2.1, wcsnrtombs mishandles particular combinations of destination buffer size and source characte
Inefficient algorithmic complexity in musl libc's GB18030 4-byte decoder (iconv function in src/locale/iconv.c) affects
GitHub PoC
Exploit-DB