8.1

CVE-2026-40200: musl-libc musl

CVSS: 8.1v3.1HighDeferred
AliasesALPINE-CVE-2026-40200UBUNTU-CVE-2026-40200DEBIAN-CVE-2026-40200
Published 10-04-2026Last modified 14-04-2026
Open JSON

Vulnerability summary

CVE-2026-40200 is a high (CVSS 8.1) vulnerability in musl-libc musl. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6.1% of scored vulnerabilities.

Overall risk
32/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.1/10
010
High · v3.1 (CVE.org)
EPSS score
0.17%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 10-04-2026
    PublishedVulnerability first disclosed.
  2. 14-04-2026
    Last modifiedVulnerability information updated.

Description

An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements must exceed about seven million, i.e., the 32nd Leonardo number on 32-bit platforms (or the 64th Leonardo number on 64-bit platforms, which is not practical).

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.17%

Chance of exploitation in the next 30 days

Percentile

6%

Versus all other CVEs

30-day change

0.00 pp

From 0.17% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.17%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Alpine1 product
  • musl< 1.2.4_git20230717-r6 | < 1.2.5-r3 | < 1.2.5-r11 | < 1.2.5-r12 | < 1.2.5-r23 | < 1.2.6-r2
Debian1 product
  • muslAll versions (No fix recorded) | < 1.2.5-3.1~deb13u1 | < 1.2.5-3.1
Musl-libc1 product
  • musl≥ 0.7.10, ≤ 1.2.6
Ubuntu1 product
  • muslAll versions (No fix recorded)

4 vendors · 4 products

References

7 links