EUVD-2026-75945
GHSA-cv45-8fc2-7w58
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
High complexity reflects the mandatory PCRE2_MATCH_INVALID_UTF flag and invalid UTF subject requirement; impact is crash-only with no confidentiality or integrity effect.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
6DescriptionCVE.org
PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.
AnalysisAI
Out-of-bounds read in PCRE2 before version 10.48 can be triggered in pcre2_match() when the PCRE2_MATCH_INVALID_UTF option is active and a subject string containing invalid UTF sequences is matched. The flaw occurs during backward scanning through invalid UTF data, where the lower buffer bound is not enforced, potentially crashing the calling application. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all three of the following: (1) the calling application must explicitly enable PCRE2_MATCH_INVALID_UTF when invoking pcre2_match() - this is a non-default, opt-in option that application code must deliberately set; (2) the subject string passed to pcre2_match() must contain invalid UTF byte sequences; and (3) the attacker must be able to supply or influence the content of that subject string (e.g., via a network-reachable input field). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L (score 3.7) accurately characterizes this as a low-severity, niche-exploitation flaw: the AC:H metric reflects that triggering the vulnerability requires an application that both explicitly enables PCRE2_MATCH_INVALID_UTF and accepts attacker-controlled input as the match subject, a non-default and relatively uncommon combination. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to PCRE2 10.48, which applies the lower buffer bound guard fixing this issue along with four other bundled security fixes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-125 – Out-of-bounds Read
View allShare
External POC / Exploit Code
Leaving vuln.today