CVE-2026-107891: musl libc: multiple integer overflow in regcomp, possibly leading to incorrect allocation sizes and out-of-bounds heap writes

Products Openwall GNU/*/Linux server OS Linux Kernel Runtime Guard John the Ripper password cracker Free & Open Source for any platform in the cloud Pro for Linux Pro for macOS Wordlists for password cracking passwdqc policy enforcement Free & Open Source for Unix Pro for Windows (Active Directory) yescrypt KDF & password hashing yespower Proof-of-Work (PoW) crypt_blowfish password hashing phpass ditto in PHP tcb better password shadowing Pluggable Authentication Modules scanlogd port scan detector popa3d tiny POP3 daemon blists web interface to mailing lists msulogin single user mode login php_mt_seed mt_rand() cracker Services Publications Articles Presentations Resources Mailing lists Community wiki Source code repositories (GitHub) File archive & mirrors How to verify digital signatures OVE IDs What’s new Follow @Openwall on Twitter for new release announcements and other news.

Openwall 产品包括 GNU/*/Linux 服务器操作系统、Linux 内核运行时防护、John the Ripper 密码破解器、适用于云端任何平台的自由开源软件、Linux 专业版、macOS 专业版、密码破解词表、passwdqc 策略执行工具、适用于 Unix 的自由开源软件、Windows 专业版（Active Directory）、yescrypt KDF 与密码哈希、yespower 工作量证明（PoW）、crypt_blowfish 密码哈希、PHP 版 phpass、tcb 更好的密码影子系统、可插拔认证模块、scanlogd 端口扫描检测器、popa3d 小型 POP3 守护进程、blists 邮件列表 Web 界面、msulogin 单用户模式登录、php_mt_seed mt_rand() 破解器。此外还提供服务、出版物、文章、演示文稿、资源、邮件列表、社区维基、源代码仓库（GitHub）、文件归档与镜像、数字签名验证方法、OVE ID 以及最新动态。请关注 @Openwall 的 Twitter 以获取新版本公告及其他新闻。

[<prev] [next>] [day] [month] [year] [list] Message-ID: 20261021154307.GA4413@brightrain.aerifal.cx Date: Wed, 21 Oct 2026 11:43:08 -0400 From: Rich Felker <dalias@…c.org> To: musl@…ts.openwall.com Cc: oss-security@…ts.openwall.com Subject: CVE-2026-107891: musl libc: multiple integer overflow in regcomp, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.

[<上一篇] [下一篇] [日] [月] [年] [列表] 消息 ID：20261021154307.GA4413@brightrain.aerifal.cx 日期：2026 年 10 月 21 日星期三 11:43:08 -0400 发件人：Rich Felker <dalias@…c.org> 收件人：musl@…ts.openwall.com 抄送：oss-security@…ts.openwall.com 主题：CVE-2026-107891：musl libc：regcomp 中存在多个整数溢出，可能导致分配大小错误及堆内存越界写入。

CVE-2026-107891: musl libc: multiple integer overflow in regcomp, possibly leading to incorrect allocation sizes and out-of-bounds heap writes Overview: The regcomp function in musl libc is affected by multiple integer overflow issues which can lead to incorrectly-sized allocations and possibly out-of-bounds heap writes. The conditions for overflow are triggered by the size and complexity of the regular expression passed to regcomp, not the data to be matched. In order to be vulnerable, an application must be processing regular expressions from an untrusted source using the libc regcomp function.

CVE-2026-107891：musl libc：regcomp 中存在多个整数溢出，可能导致分配大小错误及堆内存越界写入。概述：musl libc 中的 regcomp 函数受到多个整数溢出问题的影响，这可能导致分配大小错误，并可能引发堆内存越界写入。溢出条件是由传递给 regcomp 的正则表达式的大小和复杂性触发的，而非由待匹配的数据触发。要受到此漏洞影响，应用程序必须使用 libc 的 regcomp 函数处理来自不可信来源的正则表达式。

Impact: At least denial-of-service in the form of a predictable crash is possible. Depending on the application and its use of objects on the heap and of concurrent execution, arbitrary code execution may be possible. Affected versions: The vulnerable code has been present since version 0.5.0. All subsequent versions up through 1.2.6 are affected.

影响：至少可能导致可预测的崩溃，从而引发拒绝服务。根据应用程序及其对堆上对象的使用情况以及并发执行情况，可能实现任意代码执行。受影响版本：该漏洞代码自 0.5.0 版本起便已存在。截至 1.2.6 版本的所有后续版本均受影响。

Mitigation: All users should apply the attached patch, or upgrade to 1.2.7 once it becomes available. In contexts where patching is not an option, measures should be taken to prevent the processing of regular expressions from untrusted sources. Credits: The first of these issues was reported in private by Julien Voisin. Subsequent analysis by Szabolcs Nagy and Rich Felker found a pattern of similar overflows. View attachment “0001-regex-avoid-int-overflow-in-regcomp.patch” of type “text/plain” (5943 bytes) Powered by blists - more mailing lists Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list. Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.

缓解措施：所有用户应应用随附的补丁，或在 1.2.7 版本发布后进行升级。在无法进行补丁修复的情况下，应采取措施防止处理来自不可信来源的正则表达式。致谢：这些问题中的第一个由 Julien Voisin 私下报告。随后，Szabolcs Nagy 和 Rich Felker 的分析发现了类似溢出的模式。查看附件 “0001-regex-avoid-int-overflow-in-regcomp.patch”（类型：text/plain，大小：5943 字节）。由 blists 提供支持 - 更多邮件列表。请查看开源软件安全维基，它是本邮件列表的对应资源。对邮件列表及其使用感到困惑？请阅读维基百科上关于邮件列表的内容，并查看这些关于正确格式化消息的指南。