CVE-2025-8058

Published Jul 23, 2025

Last updated 4 months ago

CVSS medium 5.9
C++

Overview

Description
The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C library.
Source
3ff69d7a-14f2-4f67-a097-88dee7810d18
NVD status
Deferred

Risk scores

CVSS 4.0

Type
Secondary
Base score
5.9
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity
MEDIUM

Weaknesses

3ff69d7a-14f2-4f67-a097-88dee7810d18
CWE-415

Social media

Hype score
Not currently trending

  1. CVE-2025-8058: glibc: posix: Double-free after allocation failure in regcomp https://t.co/LXVNNmpW6g The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails

    @oss_security

    23 Jul 2025

    1421 Impressions

    5 Retweets

    7 Likes

    3 Bookmarks

    0 Replies

    0 Quotes

  2. CVE-2025-8058 The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished either by a m… https://t.co/rcewFO8Q0F

    @CVEnew

    23 Jul 2025

    401 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and out-of-bounds memory access. Only the C++ implementation is affected; other language implementations of Apache Fory are not. This issue affects Apache Fory C++: from 0.14.0 before 1.4.0. Users are recommended to upgrade to version 1.4.0, which fixes the issue.•CVE-2026-64608
  2. A vulnerability was found in llvm llvm-project up to 22.1.6. This affects the function llvm::StringMap::insert in the library /lib/IR/ValueSymbolTable.cpp of the component ValueSymbolTable Module. The manipulation results in stack-based buffer overflow. Attacking locally is a requirement. The exploit has been made public and could be used. The presence of this vulnerability remains uncertain at this time. The LLVM project explains, that the reported behavior is outside its documented security scope and therefore not considered a security vulnerability.•CVE-2026-13573
  3. A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst.cpp of the component Bitcode File Handler. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. There are still doubts about whether this vulnerability truly exists. The LLVM project explains, that the reported behavior is outside its documented security scope and therefore not considered a security vulnerability.•CVE-2026-13574
  4. Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.•CVE-2026-45591
  5. Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.•CVE-2026-32177

References

Sources include official advisories and independent security research.