{"id":"CVE-2026-107891","details":"musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.","modified":"2026-11-07T07:12:10.346037583Z","published":"2026-11-05T15:16:05.511Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"0.5.0"},{"fixed":"1.2.7"}],"source":"AFFECTED_FIELD"}]},{"extracted_events":[{"source":"DESCRIPTION","range":[{"fixed":"1.2.7"}]}]}],"cna_assigner":"mitre","cwe_ids":["CWE-190"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107891.json"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/10/21/18"},{"type":"WEB","url":"https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941"},{"type":"WEB","url":"https://musl.libc.org"},{"type":"WEB","url":"https://www.openwall.com/lists/musl/2026/10/21/1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107891.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107891"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.musl-libc.org/git/musl","events":[{"introduced":"0"},{"fixed":"7813e9119eb5fe681b6750b8a033a0490bca0941"}],"database_specific":{"extracted_events":[{"source":"REFERENCES_COMMIT","range":[{"fixed":"7813e9119eb5fe681b6750b8a033a0490bca0941"}]}]}}],"versions":["v1.2.6","v1.2.5","v1.2.4","v1.2.3","v1.2.2","v1.2.1","v1.2.0","v1.1.24","v1.1.23","v1.1.22","v1.1.21","v1.1.20","v1.1.19","v1.1.18","v1.1.17","v1.1.16","v1.1.15","v1.1.14","v1.1.13","v1.1.12","v1.1.11","v1.1.10","v1.1.9","v1.1.8","v1.1.7","v1.1.6","v1.1.5","v1.1.4","v1.1.3","v1.1.2","v1.1.1","v1.1.0","v1.0.0","v0.9.15","v0.9.14","v0.9.13","v0.9.12","v0.9.11","v0.9.10","v0.9.9","v0.9.8","v0.9.7","v0.9.6","v0.9.5","v0.9.4","v0.9.3","v0.9.2","v0.9.1","v0.9.0","v0.8.10","v0.8.9","v0.8.8","v0.8.7","v0.8.6","v0.8.5","v0.8.4","v0.8.3","v0.8.2","v0.8.1","v0.8.0","v0.7.12","v0.7.11","v0.7.10","v0.7.9","v0.7.8","v0.7.7","v0.7.6","v0.7.5","v0.7.1","v0.7.0","v0.6.0","v0.5.9","v0.5.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-107891.json","vanir_signatures":[{"source":"https://git.musl-libc.org/git/musl@7813e9119eb5fe681b6750b8a033a0490bca0941","target":{"file":"src/regex/regcomp.c"},"deprecated":false,"digest":{"line_hashes":["137027187212977967969356420201140848995","252131805878249038838467639976406703012","276416132483850318947938744478629110759","77471205761140202831080257382079507237","317485983738073546222657977364961448449","104457614844049081974157750201377750949","236732265184660035366467935863000898408","198376161004324168395696234833488520633","155336302125837494756161066711062350519","120593711815838175861256789745651091472","176567232960056367889833501494310823408","171729096715205669290979964134710464288","315916421582472906642253089478372965041","24892065589256406776489324876432904624","172432922402074077414446032506647060783","54093952634746758226948050617562872268","3763925161537279724186982590522103928","212170959581112209281601415607699018398","175832808054718772976987420320464745139","40171996143578669464005286158525322627","275432108927302436326357892588498406595","200248350749203599393305725802395006257","220610155184985438038514854101346525957","101724246115751869390026751613893135760","89879856735375475672146308206558527305","29095854435757987489543484433650919495","90946915898675184903679341036705793780","132035815940846870933993870154940226372","278382139372960744008463480543821528988","171770608867744731974317933935241484749","12130260582401452317622797024211540843","327132492494147403863232077081946363658","21976237256712427493062886460677282391","167913293576429212550807521967992389205","198426584969152351916187056277919129972","102923001546328004364665284292953660794","114945407732740025855054941483875219177","323837364126513103334646625440413760077","22373596387715708986473031683963124858","130311553682491419970592203340991800339","264740019442948629555152055433782129742","236679398061248037955530764803833414089","94144177680287772098554401440348538158","72893286533081498715264780295289861845","58923849087905939581729856446233712484","182908947664227457134443260144009261139","79835405512048661146563344954371977052"],"threshold":0.9},"id":"CVE-2026-107891-1a0f2fe6","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://git.musl-libc.org/git/musl@7813e9119eb5fe681b6750b8a033a0490bca0941","target":{"file":"src/regex/regcomp.c","function":"regcomp"},"deprecated":false,"digest":{"function_hash":"339038204132528471750287164829819553289","length":4271},"id":"CVE-2026-107891-2505d993"},{"deprecated":false,"digest":{"function_hash":"10463510024865183675693033665691021545","length":3285},"id":"CVE-2026-107891-ebec34a0","signature_type":"Function","signature_version":"v1","source":"https://git.musl-libc.org/git/musl@7813e9119eb5fe681b6750b8a033a0490bca0941","target":{"file":"src/regex/regcomp.c","function":"tre_expand_ast"}},{"digest":{"length":2778,"function_hash":"254247746449891617922543721539990615427"},"id":"CVE-2026-107891-f83bde7a","signature_type":"Function","signature_version":"v1","source":"https://git.musl-libc.org/git/musl@7813e9119eb5fe681b6750b8a033a0490bca0941","target":{"function":"tre_copy_ast","file":"src/regex/regcomp.c"},"deprecated":false}],"vanir_signatures_modified":"2026-11-07T07:12:10Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}