Medium severity · published Jul 23, 2025
CVE-2025-8058
The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails
5.9
CVSS
0.2%
EPSS
No
On KEV
Description
The regcomp function in the GNU C library version from 2.4 to 2.41 is
subject to a double free if some previous allocation fails. It can be
accomplished either by a malloc failure or by using an interposed malloc
that injects random malloc failures. The double free can allow buffer
manipulation depending of how the regex is constructed. This issue
affects all architectures and ABIs supported by the GNU C library.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GL
glibc · The GNU C Library
2.4 before 2.42 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8058
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8058
sourceware.org
https://sourceware.org/bugzilla/show_bug.cgi?id=33185
sourceware.org
https://sourceware.org/git/?p=glibc.git;a=commit;h=3ff17af18c38727b88d9115e536c069e6b5d601f
www.openwall.com
http://www.openwall.com/lists/oss-security/2025/07/23/1
More from glibc
9.8
CVE-2026-5450
scanf %mc off-by-one heap buffer overflow
8.4
CVE-2026-0861
Integer overflow in memalign leads to heap corruption
8.1
CVE-2024-33599
nscd: Stack-based buffer overflow in netgroup cache
7.7
CVE-2026-19499
Buffer overflow in strfmon and strfmon_l right-justification padding
7.5
CVE-2026-5928
Potential buffer under-read in ungetwc