---
cve: "CVE-2025-8058"
severity: "MEDIUM"
cvss: 5.9
epss: "16%"
vendor: "The GNU C Library"
kev: false
exploited: false
published: "2025-07-23 20:15:27"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-09-14T00:11:20+02:00"
---

# CVE-2025-8058

> 5.9 MEDIUM

## Beschreibung

The regcomp function in the GNU C library version from 2.4 to 2.41 is 
subject to a double free if some previous allocation fails. It can be 
accomplished either by a malloc failure or by using an interposed malloc
 that injects random malloc failures. The double free can allow buffer 
manipulation depending of how the regex is constructed. This issue 
affects all architectures and ABIs supported by the GNU C library.

## CVSS-Vektor

```
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Lokal | good |
| AC Komplexität | Hoch | good |
| PR Privilegien | Gering | warn |

## Patch verfügbar (OSV)

- d2097651cc57834dbfcaa102ddfacae0d86cfb66 (Commit)

## Referenzen

- <https://sourceware.org/bugzilla/show_bug.cgi?id=33185>
- <https://sourceware.org/git/?p=glibc.git;a=commit;h=3ff17af18c38727b88d9115e536c069e6b5d601f>
- <http://www.openwall.com/lists/oss-security/2025/07/23/1>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2025-8058) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_