EUVD-2026-75944
Integer Overflow or Wraparound (CWE-190)
GHSA-9v67-x694-f2jr
6.5
CVSS 3.1 · Vendor: mitre
Share
Severity by source
Vendor (mitre)
PRIMARY
6.5
MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
vuln.today
AI
6.5
MEDIUM
AC:H reflects the 32-bit platform requirement; I:H reflects heap OOB write potential; no confidentiality or scope change.
3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
Low
Lifecycle Timeline
4
Patch available
Sep 11, 2026 - 05:16 EUVD
Source Code Evidence Fetched
Sep 11, 2026 - 04:31 vuln.today
Analysis Generated
Sep 11, 2026 - 04:31 vuln.today
CVE Published
Sep 11, 2026 - 04:18 cve.org
MEDIUM 6.5
DescriptionCVE.org
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.
AnalysisAI
Integer overflow in pcre2_compile_32 on 32-bit platforms allows network-reachable attackers to trigger an out-of-bounds heap write when a PCRE2-consuming application compiles attacker-supplied regex patterns. Affected versions are all PCRE2 releases prior to 10.48. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the target system or process must be running on a 32-bit platform where size_t is 32 bits - 64-bit deployments are not affected; (2) the application consuming PCRE2 must call pcre2_compile_32 (the 32-bit character-width API), not the 8-bit or 16-bit variants; (3) the attacker must control or influence the regex pattern string passed to that compile call, which typically means the application exposes pattern input from an external channel such as a web API, configuration endpoint, or user-submitted search field. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L reflects the key limiting factor: AC:H indicates the attack is constrained to 32-bit platforms, which are increasingly uncommon in modern server deployments but remain present in embedded systems, IoT devices, and legacy infrastructure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to PCRE2 10.48 or later, available at https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48 and confirmed by the signed release tag. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).