EUVD-2026-21496Severity by source
AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements must exceed about seven million, i.e., the 32nd Leonardo number on 32-bit platforms (or the 64th Leonardo number on 64-bit platforms, which is not practical).
AnalysisAI
Stack-based buffer overflow in musl libc 0.7.10 through 1.2.6 allows local attackers with high complexity requirements to corrupt memory during qsort operations on exceptionally large arrays (exceeding ~7 million elements on 32-bit systems, corresponding to the 32nd Leonardo number). Exploitation requires sorting arrays approaching billion-element scale on 64-bit platforms. Vulnerability stems from incorrect double-word primitive implementation in smoothsort algorithm. Successful exploitation enables arbitrary code execution with scope change, impacting confidentiality, integrity, and availability. No public exploit identified at time of analysis.
Technical ContextAI
Root cause lies in flawed double-word primitive operations within musl's smoothsort qsort implementation (CWE-670). Triggers only when array size exceeds Leonardo number thresholds: 32nd Leonardo (~7M elements, 32-bit) or 64th Leonardo (impractical scale, 64-bit). Stack corruption occurs through improper boundary handling in heap construction phase.
RemediationAI
Monitor musl libc project release page (https://musl.libc.org/releases.html) for patched versions addressing this qsort vulnerability. Vendor-released patch status pending independent confirmation at time of analysis; refer to upstream announcements via https://www.openwall.com/lists/oss-security/2026/04/10/13 for technical details and patch timeline. Interim mitigation: implement application-layer input validation to prevent qsort calls on arrays exceeding 7 million elements, or substitute alternative sorting implementations for large datasets. Organizations using Alpine Linux or containerized musl-based images should prioritize tracking vendor security advisories and apply updates immediately upon availability. High attack complexity (AC:H) reduces immediate risk, but scope change (S:C) warrants urgent attention for multi-tenant environments.
musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. Rate
Multiple integer overflows in the TRE library and musl libc allow attackers to cause memory corruption via a large numbe
Stack-based buffer overflow in the inet_pton function in network/inet_pton.c in musl libc 0.9.15 through 1.0.4, and 1.1.
musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv
Stack-based buffer overflow in fprintf in musl before 0.8.8 and earlier allows context-dependent attackers to cause a de
musl libc before 1.1.17 has a buffer overflow via crafted DNS replies because dns_parse_callback in network/lookup_name.
In musl libc through 1.2.1, wcsnrtombs mishandles particular combinations of destination buffer size and source characte
Inefficient algorithmic complexity in musl libc's GB18030 4-byte decoder (iconv function in src/locale/iconv.c) affects
Same technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today