An implementation flaw in the qsort routine of musl libc causes a stack‑based memory corruption when sorting arrays that contain a very large number of elements (exceeding roughly seven million on 32‑bit systems). The bug stems from incorrectly implemented double‑word primitives, which can overwrite control data on the stack. When triggered, this overflow can allow an attacker to execute arbitrary code or crash the process. The vulnerability is related to integer overflows (CWE‑190) and uncontrolled modification of execution flow (CWE‑670).

musl libc versions 0.7.10 through 1.2.6 are affected. Systems that ship with these versions, including many Linux distributions and embedded devices that rely on musl as the standard C library, are at risk. No other vendors or products are listed. Users should verify the musl version in use and compare it to the affected range.

The CVSS base score of 8.1 indicates a high severity issue, while the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA Known Exploit Vulnerabilities catalog, further indicating low exploitation activity. Exploitation requires an attacker to construct a data set large enough to trigger the overflow (a 64‑bit environment would need an array size equal to the 64th Leonardo number, which is not practical). Therefore, the realistic attack probability for typical systems is low unless a publicly exposed service or script processes extremely large input arrays.