musl maintainer Rich Felker disclosed integer overflows in regcomp, the function that compiles regular-expression patterns, on October 21. His advisory for CVE-2026-107891 includes a patch and a specific exposure condition: an application must compile patterns supplied by an untrusted source.

musl is a C standard library, used beneath applications on Linux. The affected code has existed since 0.5.0, and upstream releases through 1.2.6 contain it. A distribution can carry a backported fix without changing that upstream version.

The pattern is the trust boundary

A regular expression describes what text to match. Here, the overflow depends on the size and complexity of that expression, rather than the text being searched.

That changes the inventory question. Start with programs that let users supply search expressions, filtering rules or other patterns. Establish whether those patterns reach musl’s regcomp. Merely running on musl, or using a different regex engine, does not establish that this path is exposed.

The arithmetic errors can produce incorrectly sized memory allocations and potentially writes outside the allocated heap. Felker says a predictable crash is possible. Arbitrary code execution may be possible depending on the application’s memory use and concurrent execution.

Evidence status: maintainer-confirmed vulnerability and crash impact; code execution remains a conditional possibility. The reviewed advisory supplies no report of exploitation in the wild or demonstrated code execution.

A patch is available; 1.2.7 is still a future release

The musl homepage currently warns about this CVE and directs users to patch. At review on October 25, it still lists 1.2.6 as the latest release. The advisory recommends applying its patch or upgrading to 1.2.7 once available. Do not mistake that future version number for an update already shipped.

For operators and application owners:

  • Use your distribution or product vendor’s security-fixed package when available. Confirm that it addresses this exact CVE. For source-maintained builds, use the upstream patch through the normal review and rebuild process.
  • Rebuild and redeploy affected images and executables. musl’s deployment documentation explains that statically linked binaries contain their library code. Updating a host’s shared library leaves those embedded copies unchanged.
  • Restart affected dynamically linked programs after updating their library. Verify the package or build actually running, including long-lived workers.
  • Until patched, prevent untrusted regular expressions from reaching regcomp. This is the maintainer’s mitigation. Restricting the text searched leaves the vulnerable pattern-compilation step unchanged.

The first issue was reported privately by Julien Voisin. Szabolcs Nagy and Rich Felker identified related overflows during follow-up analysis.

Caveat: The advisory does not identify every affected application or distribution’s fixed package revision; verify those downstream details with the responsible maintainer.