CVE-2025-8058
published 2025-07-23CVE-2025-8058: The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished either…
PriorityP423medium5.9CVSS 4.0
AVLACHATPPRLUIPVCLVILVAHSCLSILSAHEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.16%
5.4th percentile
The regcomp function in the GNU C library version from 2.4 to 2.41 is
subject to a double free if some previous allocation fails. It can be
accomplished either by a malloc failure or by using an interposed malloc
that injects random malloc failures. The double free can allow buffer
manipulation depending of how the regex is constructed. This issue
affects all architectures and ABIs supported by the GNU C library.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | glibc | < glibc 2.36-9+deb12u13 (bookworm) | glibc 2.36-9+deb12u13 (bookworm) |
| gnu | glibc | >= 0 < 2.36-9+deb12u13 | 2.36-9+deb12u13 |
| gnu | glibc | >= 0 < 2.41-11 | 2.41-11 |
| gnu | glibc | >= 0 < 2.41-11 | 2.41-11 |
| gnu | glibc | >= 0 < 2.35-0ubuntu3.13 | 2.35-0ubuntu3.13 |
| gnu | glibc | >= 0 < 2.39-0ubuntu8.7 | 2.39-0ubuntu8.7 |
| gnu | glibc | >= 0 < 2.42-0ubuntu3.1 | 2.42-0ubuntu3.1 |
| gnu | glibc | >= 0 < 2.23-0ubuntu11.3+esm9 | 2.23-0ubuntu11.3+esm9 |
| gnu | glibc | >= 0 < 2.27-3ubuntu1.6+esm6 | 2.27-3ubuntu1.6+esm6 |
| gnu | glibc | >= 0 < 2.31-0ubuntu9.18+esm1 | 2.31-0ubuntu9.18+esm1 |
| msrc | azl3_glibc_2.38-12_on_azure_linux_3.0 | — | — |
| msrc | azl3_glibc_2.38-14_on_azure_linux_3.0 | — | — |
| msrc | azl3_glibc_2.38-15_on_azure_linux_3.0 | — | — |
| the_gnu_c_library | glibc | >= 2.4 < 2.42 | 2.42 |
CVSS provenance
nvdv4.05.9MEDIUMCVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_debian5.9MEDIUM
vendor_msrc5.9MEDIUM
vendor_redhat5.9MEDIUM
vendor_oracle4.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
GNU C Library vulnerabilities
vendor_ubuntu·2026-02-03·CVSS 7.5
CVE-2026-0861 [HIGH] GNU C Library vulnerabilities
Title: GNU C Library vulnerabilities
Summary: Several security issues were fixed in GNU C Library.
Vitaly Simonovich discovered that the GNU C Library did not properly
initialize the input when WRDE_REUSE is used. An attacker could possibly
use this issue to cause applications to crash, leading to a denial of
service. (CVE-2025-15281)
Anastasia Belova discovered that the GNU C Library incorrectly handled
the regcomp function when memory allocation failures occured. An attacker
could possibly use this issue to cause applications to crash, leading to
a denial of service, or possibly execute arbitrary code. This issue only
affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2025-8058)
Igor Morgenstern discovered that the GNU C Library incorrectly handled
the memalign fu
Oracle
Oracle Oracle Communications Applications Risk Matrix: Installation (glibc) — CVE-2025-8058
vendor_oracle·2025-10-15·CVSS 4.2
CVE-2025-8058 [MEDIUM] Oracle Oracle Communications Applications Risk Matrix: Installation (glibc) — CVE-2025-8058
Oracle Oracle Communications Applications Risk Matrix: Installation (glibc) vulnerability
CVE: CVE-2025-8058
CVSS: 4.2
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpuoct2025 (OCT 2025)
Ubuntu
GNU C Library vulnerability
vendor_ubuntu·2025-09-22
CVE-2025-8058 GNU C Library vulnerability
Title: GNU C Library vulnerability
Summary: GNU C Library could be made to crash or run programs if it received
specially crafted input.
It was discovered that the GNU C Library incorrectly handled the regcomp
function when memory allocation failures occured. An attacker could use
this issue to cause applications to crash, leading to a denial of service,
or possibly execute arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
glibc: Double free in glibc
vendor_redhat·2025-07-23·CVSS 5.9
CVE-2025-8058 [MEDIUM] CWE-415 glibc: Double free in glibc
glibc: Double free in glibc
The regcomp function in the GNU C library version from 2.4 to 2.41 is
subject to a double free if some previous allocation fails. It can be
accomplished either by a malloc failure or by using an interposed malloc
that injects random malloc failures. The double free can allow buffer
manipulation depending of how the regex is constructed. This issue
affects all architectures and ABIs supported by the GNU C library.
A double-free vulnerability has been discovered in glibc (GNU C Library). This flaw occurs during bracket expression parsing within the regcomp function, specifically when a memory allocation failure takes place. Exploitation of a double-free vulnerability can lead to memory corruption, which could enable an attacker to achieve arbitrary code executio
Microsoft
The regcomp function in the GNU C library version from 2.4 to 2.41 is
subject to a double free if some previous allocation fails. It can be
accomplished either by a malloc failure or by using an int
vendor_msrc·2025-07-08·CVSS 5.9
CVE-2025-8058 [MEDIUM] CWE-415 The regcomp function in the GNU C library version from 2.4 to 2.41 is
subject to a double free if some previous allocation fails. It can be
accomplished either by a malloc failure or by using an int
The regcomp function in the GNU C library version from 2.4 to 2.41 is
subject to a double free if some previous allocation fails. It can be
accomplished either by a malloc failure or by using an interposed malloc
that injects random malloc failures. The double free can allow buffer
manipulation depending of how the regex is constructed. This issue
affects all architectures and ABIs supported by the GNU C library.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Mi
Debian
CVE-2025-8058: glibc - The regcomp function in the GNU C library version from 2.4 to 2.41 is subject t...
vendor_debian·2025·CVSS 5.9
CVE-2025-8058 [MEDIUM] CVE-2025-8058: glibc - The regcomp function in the GNU C library version from 2.4 to 2.41 is subject t...
The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C library.
Scope: local
bookworm: resolved (fixed in 2.36-9+deb12u13)
bullseye: open
forky: resolved (fixed in 2.41-11)
sid: resolved (fixed in 2.41-11)
trixie: resolved (fixed in 2.41-11)
OSV
glibc vulnerabilities
osv·2026-02-03·CVSS 7.5
CVE-2025-15281 [HIGH] glibc vulnerabilities
glibc vulnerabilities
Vitaly Simonovich discovered that the GNU C Library did not properly
initialize the input when WRDE_REUSE is used. An attacker could possibly
use this issue to cause applications to crash, leading to a denial of
service. (CVE-2025-15281)
Anastasia Belova discovered that the GNU C Library incorrectly handled
the regcomp function when memory allocation failures occured. An attacker
could possibly use this issue to cause applications to crash, leading to
a denial of service, or possibly execute arbitrary code. This issue only
affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2025-8058)
Igor Morgenstern discovered that the GNU C Library incorrectly handled
the memalign function when doing memory allocation. An attacker could
possibly use this issue
GHSA
GHSA-8xjp-c72j-67q8: The regcomp function in the GNU C library version from 2
ghsa_unreviewed·2025-07-23
CVE-2025-8058 [MEDIUM] CWE-415 GHSA-8xjp-c72j-67q8: The regcomp function in the GNU C library version from 2
The regcomp function in the GNU C library version from 2.4 to 2.41 is
subject to a double free if some previous allocation fails. It can be
accomplished either by a malloc failure or by using an interposed malloc
that injects random malloc failures. The double free can allow buffer
manipulation depending of how the regex is constructed. This issue
affects all architectures and ABIs supported by the GNU C library.
OSV
CVE-2025-8058: The regcomp function in the GNU C library version from 2
osv·2025-07-23·CVSS 5.9
CVE-2025-8058 [MEDIUM] CVE-2025-8058: The regcomp function in the GNU C library version from 2
The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C library.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-07-23
Published