Stack-based Memory Corruption in musl libc Affects Large Array Sorting
CVE-2026-40200

8.1HIGH

Key Information:

Vendor

Musl-libc

Status
Musl
Vendor
CVE Published:
10 April 2026

What is CVE-2026-40200?

A vulnerability has been identified in musl libc that causes stack-based memory corruption during the qsort operation on very large arrays. This issue arises from improperly implemented double-word primitives. If the number of elements in an array exceeds approximately seven million on 32-bit platforms or the 64th Leonardo number on 64-bit platforms, it can trigger this vulnerability. Such conditions could potentially lead to unpredictable behavior or crashes, making it crucial for developers using musl libc to assess their applications for this issue.

Affected Version(s)

musl 0.7.10 <= 1.2.6

References

https://musl.libc.org/releases.html
https://www.openwall.com/lists/oss-security/2026/04/10/13

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.