CVE-2025-8058: the gnu c library glibc Double Free
Vulnerability summary
CVE-2025-8058 is a medium (CVSS 5.9) Double Free vulnerability in the gnu c library glibc. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 4 · Related 6Timeline
- 23-07-2025PublishedVulnerability first disclosed.
- 04-11-2025Last modifiedVulnerability information updated.
Description
The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C library.
CVSS metrics
7 scores · 7 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated5.9MediumCVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H
- OSV · ChainguardEcosystem advisory · calculated5.9MediumCVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H
- NVDNIST5.9MediumCVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.21%
Chance of exploitation in the next 30 days
Percentile
10%
Versus all other CVEs
30-day change
+0.04 pp
From 0.16% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat192 products
- compat-libpthread-nonshared< 0:2.28-251.el8_10.25
- glibc< 0:2.34-168.el9_6.23 | < 0:2.28-251.el8_10.25 | < 0:2.39-46.el10_0
- glibc-all-langpacks< 0:2.34-168.el9_6.23 | < 0:2.28-251.el8_10.25 | < 0:2.39-46.el10_0
- glibc-all-langpacks-debuginfo< 0:2.28-251.el8_10.25
- glibc-benchtests< 0:2.34-168.el9_6.23 | < 0:2.28-251.el8_10.25 | < 0:2.39-46.el10_0
Opensuse2 products
- glibc&distro=openSUSE Leap 15.6< 2.38-150600.14.37.1
- glibc&distro=openSUSE Tumbleweed< 2.42-1.1
Ubuntu2 products
- eglibcAll versions (No fix recorded)
- glibc< 2.23-0ubuntu11.3+esm9 | < 2.27-3ubuntu1.6+esm6 | < 2.31-0ubuntu9.18+esm1 | < 2.35-0ubuntu3.11 | < 2.39-0ubuntu8.6
Chainguard1 product
- glibc< 2.41-r56
Debian1 product
- glibc< 2.36-9+deb12u13 | < 2.41-11
Mageia1 product
- glibc< 2.36-57.mga9
Wolfi1 product
- glibc< 2.41-r56
7 vendors · 200 products · Showing 200 of 249. Use Open JSON for the complete list.
