Memory Management Flaw in GNU C Library Affecting Multiple Versions

CVE-2026-100290

What is CVE-2026-100290?

The regcomp and regexec functions within the GNU C Library versions 2.3 through 2.44 exhibit a flaw that allows reading of freed memory and potential double free of heap blocks during memory allocation failures in regex handling. This issue arises when conducting realloc operations on arrays in memory, where pointers to memory blocks that have already been freed may persist unintentionally. Although an attacker does not need to create a special regex pattern, the flaw is triggered under specific memory pressure conditions, which can lead to a process crash. This vulnerability is present across all architectures and application binary interfaces (ABIs) supported by the GNU C Library, emphasizing the need for vigilance in system operations.

References