The vulnerability is a double free triggered by parsing a specially crafted regular expression within a CI/CD configuration file. The weakness, classified as CWE-415, allows an attacker who can authenticate to the GitLab instance to craft malicious input that causes the application to free the same memory twice, potentially corrupting the heap. When the double free occurs during regex evaluation, the subsequent use of the freed memory can be manipulated to execute arbitrary code within the GitLab process context. If successfully exploited, the attacker gains code‑execution capabilities with the same privileges as the GitLab service, exposing the entire repository infrastructure, confidential data, and potentially other services running on the same host.

All GitLab Community Edition and Enterprise Edition installations are affected. Versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 are vulnerable; any release prior to those patch levels is impacted. The official fix is distributed in GitLab 19.2.7, 19.3.3 and 19.4.1 and later releases.

The CVSS score of 9.9 marks this as critical severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the high CVSS suggests a realistic threat if the conditions can be met. Exploitation requires an authenticated user with permission to edit the CI/CD configuration file for a repository. An attacker who can commit a crafted regex payload can trigger the double free during parsing. Given the lack of public exploits and the need for repository‑level access, the immediate risk is moderate for organizations with limited permissions, but for entities that allow widespread CI/CD edits, the risk escalates to high.