Musl Libc is a lightweight C standard library implementation designed as an alternative to glibc, widely embedded in embedded Linux systems, container images, and lightweight distributions where footprint and simplicity are prioritized over feature parity. Despite its narrow product scope, the library's presence in the software supply chain means vulnerabilities can propagate across a large installed base of downstream systems that depend on it for core runtime functionality. Defenders should monitor this vendor's releases and track which products in their environment link this library, since remediation typically requires rebuilding or updating dependent software; current severity, exploitation, and exposure figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Musl Libc over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-14697CRITICAL musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. In some cases, use of this library could introduce out-of-bounds | Aug 6, 2019 | 9.8 | 31 | NO | NO |
CVE-2026-40200HIGH An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word pri | Apr 10, 2026 | 8.1 | 30 | NO | NO |
CVE-2014-3484CRITICAL Multiple stack-based buffer overflows in the __dn_expand function in network/dn_expand.c in musl libc 1.1x before 1.1.2 and 0.9.13 through 1.0.3 allow remote attackers to (1) have | Feb 20, 2020 | 9.8 | 30 | NO | NO |
CVE-2017-15650HIGH musl libc before 1.1.17 has a buffer overflow via crafted DNS replies because dns_parse_callback in network/lookup_name.c does not restrict the number of addresses, and thus an att | Oct 19, 2017 | 7.5 | 24 | NO | NO |
CVE-2015-1817CRITICAL Stack-based buffer overflow in the inet_pton function in network/inet_pton.c in musl libc 0.9.15 through 1.0.4, and 1.1.0 through 1.1.7 allows attackers to have unspecified impact | Aug 18, 2017 | 9.8 | 24 | NO | NO |
CVE-2025-26519HIGH musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8. | Feb 14, 2025 | 7.0 | 23 | NO | NO |
CVE-2020-28928MEDIUM In musl libc through 1.2.1, wcsnrtombs mishandles particular combinations of destination buffer size and source character limit, as demonstrated by an invalid write access (buffer | Nov 24, 2020 | 5.5 | 21 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Musl Libc.
Media articles that mention a CVE ID that affects a product developed by Musl Libc — matched by CVE ID, not by vendor name.