# CVE-2026-100290: Double free after allocation failure in regcomp and regexec

Status: published. Published: 2026-11-11. Updated: 2026-11-11.

The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched.  The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed.  When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again.  In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.

An attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common.  The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure.  An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process.  This issue affects all architectures and ABIs supported by the GNU C Library.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- The GNU C Library / glibc: ≥ 2.3; ≤ 2.44 (affected, custom). Source: CNA: glibc

## Severity and prioritization

- CVSS 3.1: 3.7 (low); CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L; source: CNA: glibc

- CVSS 3.1: 3.7 (low); CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L; source: NVD: 3ff69d7a-14f2-4f67-a097-88dee7810d18

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-415

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://sourceware.org/bugzilla/show_bug.cgi?id=34991 (CNA: glibc; issue-tracking)

- https://sourceware.org/bugzilla/show_bug.cgi?id=31935 (CNA: glibc; issue-tracking)

- https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0028 (CNA: glibc; vendor-advisory)

- https://sourceware.org/bugzilla/show_bug.cgi?id=31935 (3ff69d7a-14f2-4f67-a097-88dee7810d18)

- https://sourceware.org/bugzilla/show_bug.cgi?id=34991 (3ff69d7a-14f2-4f67-a097-88dee7810d18)

- https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0028 (3ff69d7a-14f2-4f67-a097-88dee7810d18)

## Provenance

- CNA: glibc: https://www.cve.org/CVERecord?id=CVE-2026-100290; retrieved 2026-11-11; source updated 2026-11-11

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100290; retrieved 2026-11-11; source updated 2026-11-11

Revision: fb3f6119e3b4a2edbb6dd783fc4414c15049f842f65fb526ceb71db81866ba7d

Canonical: https://y2.dev/cve/CVE-2026-100290

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.