AI analysis
PCRE2, the widely used Perl-compatible regular expression library, contains an out-of-bounds read (CWE-125) in pcre2_match that occurs when the JIT-compiled matcher falls back to the interpreter path and the caller supplies invalid UTF data. An attacker who can feed malformed UTF input into a matching operation can trigger a read past the end of the subject buffer, with the practical impact being a crash or limited availability loss, consistent with the low CVSS 3.1 score of 2.9 (local vector, high complexity). Because PCRE2 ships as a system library on virtually every Linux distribution and is embedded or linked into countless applications such as PHP and Git, any consumer that processes untrusted UTF input with pcre2_match and JIT enabled is potentially affected. The flaw is fixed in PCRE2 10.48. No public proof-of-concept is known, the issue is not in CISA KEV, and no exploitation has been reported in the wild.
What to do: Upgrade PCRE2 to version 10.48 or later, or install distribution-provided patched libpcre2 packages, and restart or rebuild dependent applications (e.g., PHP builds) so they pick up the fixed library. Check the installed version with 'pcre2-config --version' or your package manager, and as an interim mitigation consider disabling JIT or validating/normalizing UTF-8 input before running matches on untrusted data.
Affected
| PCRE2 project PCRE2 | all versions before 10.48 |
Estimated exposure
masshundreds of millions of installations ship libpcre2 (default regex library on virtually all Linux distributions, also embedded in PHP, Git, and countless apps) — PCRE2 is bundled with essentially every major Linux distribution and embedded in ubiquitous software such as PHP and Git, so deployed copies number in the hundreds of millions, though the subset with attacker-controlled invalid UTF input…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.