SB20260831132 - Multiple vulnerabilities in PCRE2

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260831132

SB20260831132 - Multiple vulnerabilities in PCRE2

Published: August 31, 2026

Security Bulletin ID SB20260831132
CSH Severity
High
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact

Breakdown by Severity

High 17% Medium 17% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an information disclosure issue in pcre2_serialize_encode() when processing serialized pattern data. A remote attacker can trigger the vulnerable function to disclose sensitive information.


2) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in pcre2_match() when processing invalid UTF subjects after JIT fallback to the interpreter. A remote attacker can pass a specially crafted invalid UTF subject to cause a denial of service.

Exploitation requires UTF matching, JIT support, a non-zero starting offset, and a pattern with lookbehind in the 8-bit library.


3) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to heap-based buffer overflow in pcre2_dfa_match() when processing an attacker-supplied regular expression with recursive patterns under a low heap limit. A remote attacker can supply a specially crafted regular expression to cause a denial of service.

Exploitation requires the application to use DFA matching, and the heap limit can be lowered within the pattern using the (*LIMIT_HEAP=...) control verb. Control of the subject or match context is not required.


4) Integer overflow (CVE-ID: N/A)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause memory corruption and a process crash.

The vulnerability exists due to integer overflow leading to an out-of-bounds write in pcre2_pattern_convert() when processing a very large attacker-controlled pattern using PCRE2-managed output allocation on a 32-bit system. A remote attacker can supply a specially crafted large foreign-syntax pattern to cause memory corruption and a process crash.

The issue occurs before pattern compilation or matching, and requires a 32-bit process with a non-NULL buffptr whose value is NULL.


5) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in pcre2_match() interpreter when processing invalid UTF subjects with PCRE2_MATCH_INVALID_UTF during backward character scans. A remote attacker can supply a specially crafted subject string to cause a denial of service.

Only patterns compiled with PCRE2_UTF and PCRE2_MATCH_INVALID_UTF are affected, and exploitation requires an invalid subject beginning with a UTF continuation code unit together with affected backward-walking pattern operations such as \\X or variable-length lookbehind.


6) Integer overflow (CVE-ID: N/A)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to integer overflow in pcre2_compile_32() when compiling a large attacker-controlled pattern. A remote attacker can supply a carefully crafted pattern to cause memory corruption.

Only the 32-bit code-unit library running in a 32-bit process is vulnerable. The issue does not affect the 8-bit or 16-bit libraries.


Remediation

Install update from vendor's website.

References