Out-of-Bounds Write in PCRE2 Regular Expression Library (pcre2_dfa_match)
PCRE2, the widely embedded Perl-compatible regular expression library, contains an out-of-bounds write in its pcre2_dfa_match function because the code path that reuses a cached workspace block skips the size check that a newly allocated block performs. Triggering the flaw requires either an attacker-controlled regular expression or a recursive pattern combined with a small heap limit set through the API, conditions that arise in applications that let users supply regex patterns or tune PCRE2's heap limit. A successful attacker can write beyond the workspace buffer, corrupting data (high integrity impact per CVSS 3.1) with only low availability impact; code execution is not documented. Any application, service, or language runtime bundling PCRE2 before 10.48 is affected, with real-world exposure concentrated in software that passes user-controlled regexes to the library. No public proof-of-concept or in-the-wild exploitation is known, EPSS puts the 30-day exploitation probability at 0.4%, and the flaw is fixed in PCRE2 10.48.
· PCRE2 project PCRE2 All versions before 10.48 (fixed in 10.48)mass
In the Linux kernel, the following vulnerability has been resolved:
In the Linux kernel, the following vulnerability has been resolved: net/rds: handle zerocopy send cleanup before the message is queued A zerocopy send can fail after user pages have been pinned but before the message is attached to the sending socket. The purge path currently infers zerocopy state from rm->m_rs, so an unqueued message can be cleaned up as if it owned normal payload pages. However, zerocopy ownership is really determined by the presence of op_mmp_znotifier, regardless of whether the message has reached the socket queue. Capture op_mmp_znotifier up front in rds_message_purge()…
· linux linux kernel—
Incorrect free (double free) in PCRE2 JIT matching before 10.48
PCRE2, the widely embedded Perl-compatible regular-expression library, contains a memory-management flaw (CWE-590, multiple/incorrect frees of an allocation) in its JIT matching entry point pcre2_jit_match: when a match context carries a previously copied subject, the routine can perform an incorrect free operation on that memory. The bug is only reachable when an application calls pcre2_jit_match with such a copied-subject context, and the CVSS vector (AV:L/AC:H) indicates exploitation requires local or in-process access under specific conditions, making a straightforward remote exploit unlikely. An attacker who can steer a vulnerable application into this call path could corrupt the heap, potentially causing a crash (denial of service) and, per the high confidentiality/integrity/availability ratings, possibly memory disclosure or code execution. Any system running software built with PCRE2 versions before 10.48 that uses the affected JIT call pattern is potentially affected; the flaw is fixed in PCRE2 10.48. There is currently no public proof-of-concept, the issue is not listed in CISA's Known Exploited Vulnerabilities catalog, and no exploitation has been reported in the wild.
· PCRE2 project PCRE2 all versions before 10.48 (fixed in 10.48)mass
Out-of-Bounds Write via Integer Overflow in PCRE2 on 32-bit Platforms
PCRE2, the widely embedded open-source regular-expression library, contains an integer overflow (CWE-190) in its pcre2_compile_32 function on 32-bit platforms, which can result in an out-of-bounds write. It is triggered when an application running a vulnerable PCRE2 build (before 10.48) on a 32-bit platform compiles a crafted regular expression meeting the specific memory-size conditions implied by the high attack complexity score. An attacker who can get such a pattern compiled gains memory corruption with high integrity impact and low availability impact per the CVSS score, meaning tampering or possible crashes rather than data disclosure. Anyone deploying PCRE2 before 10.48 on 32-bit builds is affected, including downstream distributions, language runtimes and appliances that bundle the library; 64-bit deployments are not described as affected. There is no public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation is known; the fix shipped with the PCRE2 10.48 release.
· PCRE2 project PCRE2 regular expression library all versions before 10.48, on 32-bit platformsmass
Out-of-Bounds Write in PCRE2 32-Bit Builds via Attacker-Supplied Large Patterns
PCRE2 before 10.48 contains an integer-overflow flaw (CWE-190) in the pcre2_pattern_convert function that leads to an out-of-bounds write, but only on 32-bit platforms and only when an attacker can supply a sufficiently large pattern. An application or service that compiles untrusted patterns on a 32-bit build is therefore exposed: successful corruption can modify memory outside the intended buffer, with the CVSS vector indicating high integrity impact and low availability impact but no confidentiality impact. Affected users are any products or deployments that ship or link a 32-bit build of PCRE2 older than 10.48 and pass attacker-controlled pattern data to the library; 64-bit deployments are not affected by this issue. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and there are no confirmed reports of exploitation in the wild.
· PCRE2 project PCRE2 all versions before 10.48 on 32-bit platformsmass
Out-of-bounds read in libpcap BPF interpreter can crash packet-capture processes
libpcap's userspace BPF interpreter fails to detect two malformed conditions in a loaded filter program: execution reaching the end of the filter buffer without a return instruction, and a jump instruction whose offset resolves to a pointer outside the buffer. If such a crafted filter program is executed — which the maintainer notes happens only in uncommon use cases, since filters normally run in the kernel — the interpreter reads process memory far beyond the buffer, sweeping up to 32 GiB around it on 64-bit systems or the entire address space on 32-bit systems. The consequence is a crash of the capturing process (a local denial of service): the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, availability-only) confirms a low-privilege local availability issue with no confidentiality or integrity impact. Potentially affected are applications that link libpcap and apply user-supplied filter programs through its interpreter, most prominently tcpdump and other packet-capture and monitoring tools built on the library. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is known, and EPSS estimates only a 0.1% chance of exploitation within 30 days.
· tcpdump.org libpcap Releases prior to 1.10.7 (fixed in libpcap 1.10.7, which addresses this and six other vulnerabilities)mass
Out-of-Bounds Read in PCRE2 pcre2_match on Invalid UTF Subjects
PCRE2 before 10.48 contains an out-of-bounds read (CWE-125) in the pcre2_match function when matching is performed with the PCRE2_MATCH_INVALID_UTF option and the subject string contains invalid UTF. An attacker who can feed a malformed, invalid-UTF subject string to an application using the affected library with that option can trigger the flaw, with the practical result being at most a low-impact availability problem (per the CVSS 3.1 score of 3.7, no confidentiality or integrity impact). Any application, service, or package that links PCRE2 and processes untrusted input as a match subject with PCRE2_MATCH_INVALID_UTF is affected, which given the library's ubiquity spans most Linux distributions, PHP-style runtimes, and many compiled applications. There is currently no known exploitation in the wild, no public proof-of-concept, and the issue is not listed in CISA's KEV catalog.
· PCRE2 (Philip Hazel / pcre2 project) PCRE2 all versions before 10.48mass
Out-of-Bounds Read in PCRE2 pcre2_match via JIT Fallback on Invalid UTF Data
PCRE2, the widely used Perl-compatible regular expression library, contains an out-of-bounds read (CWE-125) in pcre2_match that occurs when the JIT-compiled matcher falls back to the interpreter path and the caller supplies invalid UTF data. An attacker who can feed malformed UTF input into a matching operation can trigger a read past the end of the subject buffer, with the practical impact being a crash or limited availability loss, consistent with the low CVSS 3.1 score of 2.9 (local vector, high complexity). Because PCRE2 ships as a system library on virtually every Linux distribution and is embedded or linked into countless applications such as PHP and Git, any consumer that processes untrusted UTF input with pcre2_match and JIT enabled is potentially affected. The flaw is fixed in PCRE2 10.48. No public proof-of-concept is known, the issue is not in CISA KEV, and no exploitation has been reported in the wild.
· PCRE2 project PCRE2 all versions before 10.48mass
Two-byte information disclosure in PCRE2 pcre2_serialize_encode before 10.48
PCRE2 before 10.48 contains an information-disclosure flaw in pcre2_serialize_encode, the API used to serialize compiled regular-expression patterns for storage or transfer between processes. When the function runs, it may disclose two bytes of memory to an adversary; the CVSS 2.9 score reflects a local attack vector with high attack complexity and only a low confidentiality impact (no integrity or availability effect). An attacker gains at most two bytes of memory contents, and the advisory itself notes the leak typically matters only in situations where the adversary already has an unsafe level of access to the application. PCRE2 is an extremely widely bundled regex library (shipped in PHP, nearly every Linux distribution, and countless applications), but only software that actually invokes the rarely used serialize/encode API can expose the leak. No public proof of concept is known, the issue is not in CISA's KEV, and no exploitation has been reported; the flaw is fixed in PCRE2 10.48.
· PCRE2 Project (open source) PCRE2 all versions prior to 10.48mass