CVE-2025-8058 Use after free in glibc
A double free vulnerability in glibc's regcomp function allows attackers to manipulate buffers and potentially execute code via crafted regex inputs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-8058?
CVE-2025-8058 is a medium-severity use after free vulnerability in The GNU C Library glibc, published on 23 Jul 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C library.
Weakness: CWE-415
Which versions are affected by CVE-2025-8058?
Linux distribution packages (40)
glibc-doc AlmaLinux:10 | All versions | 2.39-46.el10_0.alma.1 |
compat-libpthread-nonshared AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-all-langpacks AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-benchtests AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-common AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-devel AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-doc AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-gconv-extra AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-headers AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-aa AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-af AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-agr AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-ak AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-am AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-an AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-anp AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-ar AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-as AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-ast AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-ayc AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-az AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-be AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-bem AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-ber AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-bg AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-bhb AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-bho AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-bi AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-bn AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-bo AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-br AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-brx AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-bs AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-byn AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-ca AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-ce AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-chr AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-cmn AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
glibc-langpack-crh AlmaLinux:8 | All versions | 2.28-251.el8_10.25 |
How do I fix CVE-2025-8058?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-8058 being exploited?
There is no known exploitation of CVE-2025-8058 in the wild and no public exploit code.
Sources
Also known as ALSA-2025:12980, ALSA-2025:13240, AZL-68609, BELL-CVE-2025-8058, CLSA-2025-1755005189, CLSA-2025-1755007232 and 24 more.