CVE-2025-8058

What it actually does

Double-free condition in regcomp during regex compilation when a prior allocation fails, enabling memory corruption and potential buffer manipulation.

Why it matters to the business

Applications relying on glibc regex processing face elevated risk of crashes or limited local code execution; the issue affects widely used base libraries across many distributions and downstream packages, increasing patching urgency for exposed systems.

How an attack unfolds

An attacker with local access crafts a regex pattern that triggers allocation failures (via natural malloc pressure or an interposed allocator), causing regcomp to free the same buffer twice and allowing subsequent memory manipulation depending on regex construction.

How to fix it

Upgrade the GNU C library to a version containing the fix; for the listed packages apply kubescape (Chainguard) 3.0.38-r1 or kubescape (Wolfi) 3.0.38-r1 and rebuild any dependent images or containers.

How to confirm the fix worked

Confirm glibc package version is newer than 2.41, test affected applications with regex inputs that previously triggered allocation failures, and verify no double-free occurs under those conditions.

Typical attack path

1. Obtain local user access on target system
2. Identify or deploy an application that invokes regcomp on attacker-controlled input
3. Trigger allocation failure during regex compilation via crafted pattern or malloc interposition
4. Exploit resulting double-free for memory corruption or limited code execution

How to detect it

Review system and application logs for unexpected crashes or memory errors during regex operations; examine process core dumps or sanitizer reports indicating double-free conditions in regcomp.

What your security team should do

• Prioritize patching glibc on all systems within 30 days given widespread library usage
• Inventory applications performing regex compilation with untrusted patterns
• Apply the exact fixed package versions for kubescape deployments
• Monitor for future EPSS increases or public exploit code