AI analysis
PCRE2, the widely embedded Perl-compatible regular expression library, contains an out-of-bounds write in its pcre2_dfa_match function because the code path that reuses a cached workspace block skips the size check that a newly allocated block performs. Triggering the flaw requires either an attacker-controlled regular expression or a recursive pattern combined with a small heap limit set through the API, conditions that arise in applications that let users supply regex patterns or tune PCRE2's heap limit. A successful attacker can write beyond the workspace buffer, corrupting data (high integrity impact per CVSS 3.1) with only low availability impact; code execution is not documented. Any application, service, or language runtime bundling PCRE2 before 10.48 is affected, with real-world exposure concentrated in software that passes user-controlled regexes to the library. No public proof-of-concept or in-the-wild exploitation is known, EPSS puts the 30-day exploitation probability at 0.4%, and the flaw is fixed in PCRE2 10.48.
What to do: Upgrade PCRE2 to 10.48 or later, and install vendor updates (new PHP packages, distribution packages, or application releases) that bundle the fixed library. Audit whether your applications expose user-supplied regular expressions or call pcre2 APIs with recursive patterns and a reduced heap limit, and restrict or validate such inputs until patched. No public PoC or in-the-wild exploitation is known, so no emergency action is required beyond normal patching.
Affected
| PCRE2 project PCRE2 | All versions before 10.48 (fixed in 10.48) |
Estimated exposure
mass≈millions of installations of software bundling PCRE2 (e.g., PHP, Apache HTTP Server); the directly exploitable subset is unknown — PCRE2 is one of the most widely deployed regex engines, bundled by PHP, the Apache HTTP Server, and many other open-source projects, implying millions of vulnerable copies in the wild, though only applications that accept…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).