The vulnerability arises when an untrusted regular expression is compiled with musl libc’s regcomp before version 1.2.7. The function miscalculates the size of the internal structures, allowing integer overflows that result in out‑of‑bounds heap writes. This corrupts memory and can potentially be used to alter program execution or execute arbitrary code, representing a serious security risk.

Any system that uses musl libc before 1.2.7 is affected. This includes many lightweight or embedded Linux distributions that rely on musl, as well as any custom applications statically or dynamically linked against versions of musl older than 1.2.7. The exact version boundary is clear: all releases prior to 1.2.7.

The CVSS score of 8.1 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV. The likely attack vector involves an attacker supplying a crafted regular expression to an application that uses regcomp. While no proof of exploitation is published, the presence of a heap overflow can lead to remote code execution on vulnerable systems. Administrators should treat this as a high‑risk flaw.