CVE-2026-40200

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements must exceed about seven million, i.e., the 32nd Leonardo number on 32-bit platforms (or the 64th Leonardo number on 64-bit platforms, which is not practical).

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-670

Affected software

No affected versions have been published.

Timeline

Published: Apr 10, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-402015.4@diplodoc/search-extension 1.0.0 through 3.x before 3.0.3 allows stored XSS via the title in a .md file.CVE-2026-402033.7When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attac CVE-2026-402043.1None None None No publicly available exploits are known.CVE-2026-402055.9An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is requi CVE-2026-402083.7An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET queries with an invalid DATA frame.CVE-2026-402095.3An attacker might be able to cause outgoing TCP connections to backend to be stuck until a timeout occurs instead of being released immediat CVE-2026-40218.1The Contest Gallery plugin for WordPress is vulnerable to an authentication bypass leading to admin account takeover in all versions up to, CVE-2026-402104.8An out-of-bounds read might happen when SetMacAddrAction is used, potentially resulting in uninitialized memory being sent over the network CVE-2026-402115.3An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buf CVE-2026-402125.4OpenStack Skyline before 5.0.1, 6.0.0, and 7.0.0 has a DOM-based Cross-Site Scripting (XSS) vulnerability in the console because document.wr CVE-2026-402137.4OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints. This unconditionally author CVE-2026-402146.3In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column