This vulnerability affects musl libc versions 0.7.10 through 1.2.6 and is caused by an incorrect control flow implementation (CWE-670) in the qsort function. Specifically, the issue arises from the handling of double-word primitives during sorting, which can lead to stack-based memory corruption when sorting very large arrays. The triggering condition requires arrays larger than approximately seven million elements on 32-bit systems, making exploitation on 64-bit systems impractical due to the even larger required array size. The CVSS v3.1 score is 8.1, indicating high severity, with attack vector local, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation can cause stack-based memory corruption, potentially leading to arbitrary code execution or denial of service. However, the exploitability is constrained by the requirement to sort extremely large arrays, which limits practical attack scenarios. The vulnerability impacts confidentiality, integrity, and availability as per the CVSS assessment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor musl-libc project communications for updates and consider avoiding sorting extremely large arrays with affected versions until a fix is available.