Vulnerability · Published Apr 10, 2026 · Assigned by mitre
CVE-2026-40200
High 8.1
In plain English
A high-severity security flaw in musl from musl-libc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements must exceed about seven million, i.e., the 32nd Leonardo number on 32-bit platforms (or the 64th Leonardo number on 64-bit platforms, which is not practical).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | musl | 1.2.5-r3 | ALPINE-CVE-2026-40200 |
| Alpine:v3.21 | musl | 1.2.5-r11 | ALPINE-CVE-2026-40200 |
| Alpine:v3.22 | musl | 1.2.5-r12 | ALPINE-CVE-2026-40200 |
| Alpine:v3.23 | musl | 1.2.5-r23 | ALPINE-CVE-2026-40200 |
| Alpine:v3.24 | musl | 1.2.6-r2 | ALPINE-CVE-2026-40200 |
| Debian:12 | musl | no fix listed | DEBIAN-CVE-2026-40200 |
| Debian:13 | musl | 1.2.5-3.1~deb13u1 | DEBIAN-CVE-2026-40200 |
| Debian:14 | musl | 1.2.5-3.1 | DEBIAN-CVE-2026-40200 |
| Ubuntu:22.04:LTS | musl | no fix listed | UBUNTU-CVE-2026-40200 |
| Ubuntu:24.04:LTS | musl | no fix listed | UBUNTU-CVE-2026-40200 |
| Ubuntu:25.10 | musl | no fix listed | UBUNTU-CVE-2026-40200 |
| Ubuntu:26.04:LTS | musl | no fix listed | UBUNTU-CVE-2026-40200 |
| Ubuntu:26.10 | musl | no fix listed | UBUNTU-CVE-2026-40200 |
Affected products (as reported)
Weakness: CWE-670 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H