PCRE2 EUVD-2026-75945

Exploitation requires all three of the following: (1) the calling application must explicitly enable PCRE2_MATCH_INVALID_UTF when invoking pcre2_match() - this is a non-default, opt-in option that application code must deliberately set; (2) the subject string passed to pcre2_match() must contain invalid UTF byte sequences; and (3) the attacker must be able to supply or influence the content of that subject string (e.g., via a network-reachable input field). Standard PCRE2 usage - including default pcre2_match() calls without PCRE2_MATCH_INVALID_UTF - is not affected. The high attack complexity (AC:H in CVSS) reflects both the non-default flag requirement and the need to craft an invalid UTF sequence that hits the specific backward-scan boundary condition. Applications using PCRE2 for pattern matching on already-validated UTF input are not at risk.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L (score 3.7) accurately characterizes this as a low-severity, niche-exploitation flaw: the AC:H metric reflects that triggering the vulnerability requires an application that both explicitly enables PCRE2_MATCH_INVALID_UTF and accepts attacker-controlled input as the match subject, a non-default and relatively uncommon combination. No CISA KEV entry exists and no POC is referenced, indicating no public exploitation activity. EPSS data is not provided in the input, but given the specific trigger conditions, even a mid-sized municipal IT team in mielec running standard PHP or nginx deployments would be unaffected unless their application code specifically opts into PCRE2_MATCH_INVALID_UTF and processes untrusted strings through it. The impact ceiling is a process crash (partial availability loss), not persistent compromise or data exposure. Notably, PCRE2 10.48 bundles four additional security fixes - including a heap write on 32-bit platforms (GHSA-3r4p-g7gg-ppmf) and integer overflows during pattern compilation (GHSA-fmgr-6ggq-9859) - several of which appear more severe; the aggregate motivation to upgrade is therefore higher than this CVE's score alone suggests.

An attacker submits a crafted string containing deliberate invalid UTF-8 sequences to a web application that passes user input directly as the subject argument to pcre2_match() with the PCRE2_MATCH_INVALID_UTF flag enabled. During backward UTF scanning, the engine reads below the lower bound of its internal buffer, causing a crash and transient denial of service for the affected process or thread. No public exploit code has been identified, and the high attack complexity reflects the need to both identify an application using this non-default flag and craft an input that triggers the specific boundary condition.