Executive brief
PCRE2 is a widely-used regular expression library embedded in many applications and system utilities. A flaw in its DFA (deterministic finite automaton) matching engine allows an attacker who can control a regular expression pattern to trigger a heap buffer overflow, potentially crashing the application or enabling code execution. This vulnerability requires the application to use the pcre2_dfa_match() function with untrusted patterns or a recursive pattern combined with a low heap limit.
Technical details
The vulnerability is a heap buffer overflow (CWE-122) in PCRE2's DFA matching workspace management. The more_workspace() function in pcre2_dfa_match.c reuses a cached workspace block without checking whether it is large enough for the new request, even though freshly-allocated blocks are subject to a size check. An attacker can craft a regular expression using nested assertions and recursion, optionally combined with a (*LIMIT_HEAP=...) pattern control verb, to force allocation of a small workspace block followed by a request for a larger block. The cached smaller block is then reused, and subsequent writes to the workspace exceed the allocation bounds. The attack vector is network/local (requires attacker-controlled regex), and affects PCRE2 versions 10.32 through 10.47. The fix (version 10.48) adds bounds checks before reusing cached blocks and hardens integer-overflow calculations.
Affected products
- PCRE2Project PCRE2 10.32 through 10.47
Timeline
- 2026-08-31: disclosed: PCRE2 10.48 released with fix
- 2026-09-05: advisory: CVE-2026-86145 published