EUVD-2026-75946
GHSA-7g92-94jm-fx5f
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Library flaw with local host inheritance (AV:L) and low privilege (PR:L); AC:H because it fires only under a specific COPY_MATCHED_SUBJECT-then-JIT-reuse pattern; incorrect free can reach full memory corruption (C/I/A:H).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionNVD
In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.
AnalysisAI
An incorrect free in the PCRE2 JIT fast path (all versions before 10.48) can corrupt process memory when an application reuses a single match data block across a pcre2_match call made with the PCRE2_COPY_MATCHED_SUBJECT option and a subsequent pcre2_jit_match call against a JIT-compiled pattern, yielding high confidentiality, integrity, and availability impact on the host process. Exploitation requires local access with low privileges and depends on a specific, uncommon API sequence inside the PCRE2-consuming application rather than on attacker-controlled input, which sharply narrows realistic exposure; the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, CISA SSVC rates exploitation as none and automatable as no, no public exploit was identified at time of analysis, and EPSS is 0.11% (1st percentile). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a PCRE2-consuming application (version <10.48) built with JIT support that uses a specific, uncommon API sequence: call pcre2_match with the PCRE2_COPY_MATCHED_SUBJECT option on a match_data block, then reuse that same block on the JIT fast path via pcre2_jit_match. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals converge on this being a genuine but low-priority memory-safety bug rather than an urgent threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to PCRE2 10.48 (release tag pcre2-10.48 at https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48, which contains the fix merged via pull request https://github.com/PCRE2Project/pcre2/pull/937); downstream distributions and language runtimes should track their packaged libpcre2 update, since third-party applications inherit the vulnerability through the shared library. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all applications and systems that bundle or depend on PCRE2 versions before 10.48, prioritizing any that accept untrusted local users or run in multi-tenant environments; within 7 days, apply the vendor-released patch: PCRE2 10.48 or later, or update the consuming application to a version that includes the fixed library, and verify successful deployment; within 30 days, audit remaining instances for the vulnerable API sequence (pcre2_match with PCRE2_COPY_MATCHED_SUBJECT followed by pcre2_jit_match) and ensure all are patched, and monitor for signs of memory corruption or unusual process behavior.
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandl
Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCRE2 10.10 allows remote attackers to execute arbitrary code v
pcre2test.c in PCRE2 10.23 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly
PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cau
PCRE2 before 10.30 has an out-of-bounds write caused by a stack-based buffer overflow in pcre2_match.c, related to a "pa
An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the
An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of
libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation viol
Out-of-bounds heap write in PCRE2 before 10.48 allows memory corruption via the DFA matching engine when a cached worksp
An out-of-bounds heap write in PCRE2's pcre2_convert() pattern-conversion API affects releases before 10.48, but only on
Out-of-bounds read in PCRE2 before version 10.48 can be triggered in pcre2_match() when the PCRE2_MATCH_INVALID_UTF opti
Integer overflow in pcre2_compile_32 on 32-bit platforms allows network-reachable attackers to trigger an out-of-bounds
Same weakness CWE-590 – Free of Memory not on the Heap
View allShare
External POC / Exploit Code
Leaving vuln.today