If you patched GitLab on October 12 for CVE-2026-97229 and called it done, it is not done. Nine days later, GitLab disclosed CVE-2026-110264: a second CVSS 10.0 unauthenticated RCE. Same root cause category, different attack surface. An integer overflow in the regex compiler, this time reachable through an Org-mode .org file in a public project. The October 12 patch does not cover it.
The affected range is what makes this one worse. CVE-2026-97229 hit three recent minor versions of the 19.x line. CVE-2026-110264 hits every release from 7.0 through current, which is twelve years of GitLab history. The flaw was always there in the Org-mode renderer. Nobody was looking.
The attack path does not require write access. A public project, one .org file containing a crafted regular expression, and GitLab’s regex compiler overflows an integer boundary and writes attacker-controlled bytes. Code runs as the git user. From there, the typical follow-on is hook injection into any repository the service account touches, which on most self-managed instances is all of them.
CVE-2026-97229 was narrower: the attacker needed to commit a malicious .gitlab-ci.yml with a UTF-8 character trick in the repository path, which requires more access. Both still score CVSS 10.0 because the scoring model weights reachability, not ease. Rapid7 reproduced code execution against an unpatched instance within two days of the October 12 disclosure. That is the baseline for how fast this category of bug gets weaponized.
Fixed versions for CVE-2026-110264: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13, and the corresponding patch for any older supported line. If you are running anything earlier than 18.11, you are holding two CVSS 10.0 holes and one of them covers every version you have ever run.
No confirmed exploitation in the wild as of October 22. That is the window, not a reason to wait. An integer overflow in a regex compiler that processes untrusted input from public projects is not a theoretical path; it is a practical one once a PoC circulates. The same integer-overflow-in-parser pattern has been the story behind CVE-2026-111497 in the Brotli decoder last week and PHP2Shell’s multipart parser bugs the week before. Parsers that trust attacker-controlled length fields keep producing CVSS 10.0 bugs.
If you run self-managed GitLab: update to the patch version for your minor line. Both CVEs need separate fixes; check your version against both. More context on this month’s pattern of parser-class vulnerabilities in the kernel and security hub.