CVSS 3.1
3.7 lowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:LCVE-2026-100290 Double free after allocation failure in regcomp and regexec
Low (3.7) in the gnu c library glibc. EPSS 0.3% estimated probability of exploitation activity in the next 30 days.
On this page
The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched. The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed. When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again. In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.
An attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common. The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure. An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process. This issue affects all architectures and ABIs supported by the GNU C Library.
Severity
- EPSS
- 0.3% estimated probability of exploitation activity in the next 30 days; 27th percentile. Scored 2026-11-13. A forecast for this CVE across the internet, not for your own systems.
- CWE
- CWE-415 Double Free
- Published
- Modified
- Assigned by
- glibc (CNA)
- NVD analysis
- Awaiting analysis
- Record from
- the NVD, synced
Ask an AI about this CVE
Show the prompt
Explain CVE-2026-100290 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-100290?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-100290?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-100290 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.
Badge for a README or a site
An image that stays current: it is drawn from the data each time it is fetched (a host that proxies images, as GitHub does, may show its copy for a while). Markdown:
[](https://cve.bz/cve/CVE-2026-100290)
HTML:
<a href="https://cve.bz/cve/CVE-2026-100290"><img src="https://cve.bz/cve/badge/CVE-2026-100290.svg" alt="CVE-2026-100290"></a>
Affected
- the gnu c library:glibc
Versions
From the CNA's record in the CVE List.
| Product | Affected |
|---|---|
| The GNU C Library glibc | from 2.3 through 2.44 |
Linux distributions
| Distribution | Release | Package | Fixed in | Advisory |
|---|---|---|---|---|
| Debian | 12, 13, 14 | glibc | no fix listed | DEBIAN-CVE-2026-100290 |
| Ubuntu | 22.04:LTS, 24.04:LTS, 26.04:LTS and 4 more | glibc | no fix listed | UBUNTU-CVE-2026-100290 |
| Ubuntu | Pro:14.04:LTS | eglibc | no fix listed | UBUNTU-CVE-2026-100290 |
| Azure Linux | 3 | glibc | no fix listed | AZL-113345 |
From the distributions' data via OSV.dev: the Debian Security Tracker; Ubuntu Security Notices © Canonical Ltd., CC BY-SA 4.0; Microsoft's Azure Linux vulnerability data, MIT. Modified: reformatted and linked to CVE records. Credits. On the distributions' own pages: Debian · Ubuntu.