EUVD-2026-75943
GHSA-797w-fgfq-r75v
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
Pattern input is attacker-supplied string data; many PCRE2 consumers are network-facing; 32-bit platform requirement justifies AC:H; no confidentiality impact from write-only corruption.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.
AnalysisAI
Out-of-bounds heap write in PCRE2's pcre2_convert() function on 32-bit platforms allows any attacker who can supply a large, attacker-controlled pattern string to corrupt heap memory with high integrity impact. Affected releases are all PCRE2 versions before 10.48 on architectures where size_t is 32 bits; 64-bit systems are unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two simultaneous conditions to be met: the target process must be running on a 32-bit platform where size_t is a 32-bit type (ruling out all 64-bit systems regardless of PCRE2 version), and the application must call pcre2_convert() / pcre2_pattern_convert() with a pattern string of sufficient length to trigger size_t arithmetic overflow. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS score of 5.7 (AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L) reflects two principal constraints: local attack vector and high attack complexity driven by the 32-bit platform requirement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to PCRE2 10.48 or later, available at https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today