CVE-2026-40200

CVE-2026-40200 is a stack-based memory corruption vulnerability affecting musl libc versions 0.7.10 through 1.2.6, triggered during quicksort operations on exceptionally large arrays exceeding approximately seven million elements. The vulnerability stems from incorrectly implemented double-word primitives in the sorting algorithm. While musl libc is commonly used in embedded systems and lightweight Linux distributions, practical exploitation requires extraordinarily large datasets that exceed the 32nd Leonardo number on 32-bit systems or 64th on 64-bit systems. The vulnerability carries a CVSS 3.1 score of 8.1 (HIGH) with a local attack vector, high complexity, and no privilege requirements. Successful exploitation could result in complete system compromise, including high-impact consequences to confidentiality, integrity, and availability. The EPSS score of 0.00018 indicates this vulnerability ranks lower than 99.95 percent of all CVEs in terms of exploitation likelihood. There is currently no evidence of active exploitation, no formal entry in CISA's Known Exploited Vulnerabilities catalog, and the vulnerability remains inactive on threat tracking lists. The extreme impracticality of the exploitation conditions—requiring datasets of over seven million elements in a sorting operation—significantly limits real-world attack scenarios and community attention.