PCRE2 EUVD-2026-75944

Exploitation requires three concurrent conditions: (1) the target system or process must be running on a 32-bit platform where size_t is 32 bits - 64-bit deployments are not affected; (2) the application consuming PCRE2 must call pcre2_compile_32 (the 32-bit character-width API), not the 8-bit or 16-bit variants; (3) the attacker must control or influence the regex pattern string passed to that compile call, which typically means the application exposes pattern input from an external channel such as a web API, configuration endpoint, or user-submitted search field. The CVSS PR:N rating applies only when no authentication is required by the consuming application to submit a pattern. Exploitation is further constrained by the scarcity of 32-bit server deployments in modern infrastructure - embedded and IoT targets are the most realistic attack surface.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L reflects the key limiting factor: AC:H indicates the attack is constrained to 32-bit platforms, which are increasingly uncommon in modern server deployments but remain present in embedded systems, IoT devices, and legacy infrastructure. The I:H rating is credible - a controlled out-of-bounds heap write can corrupt adjacent allocations in ways that lead to code execution or data manipulation, even when confidentiality impact is absent. The A:L rating acknowledges the possibility of crashes without guaranteeing them. No public exploit exists, and EPSS data is not provided, but the CVSS network vector is meaningful only when the consuming application exposes pattern compilation to untrusted input - for instance, a web application that compiles user-supplied regular expressions server-side on a 32-bit host. An EPSS score is not available in the provided data, so exploitation probability is inferred from the platform constraint alone. Even a mid-sized municipal IT team in mielec running 32-bit ARM or MIPS-based appliances that embed PCRE2 for log parsing or intrusion detection should treat this as a targeted but real risk if those appliances expose pattern input to external users. No KEV listing and no POC place this at a lower immediacy than CVSS I:H alone might suggest.

An attacker sends a specially crafted regular expression string to a web service or API endpoint that passes user-supplied patterns directly to PCRE2's compile function on a 32-bit host. The oversized pattern triggers an integer overflow in internal size calculations, causing PCRE2 to allocate a heap buffer smaller than required and then write beyond its boundary, potentially corrupting adjacent heap metadata or data. No public proof-of-concept code has been identified at time of analysis, but the out-of-bounds write primitive is generally considered a building block for memory corruption exploits.