Executive brief
PCRE2 is a regular expression matching library used in many applications and systems. When an application processes untrusted input with specific JIT and pattern options, a malformed UTF sequence can cause the library to read beyond the input buffer and crash with a denial-of-service error. This affects any service or application that performs pattern matching on untrusted data.
Technical details
The vulnerability is an out-of-bounds read in the pcre2_match() function that occurs when JIT compilation is configured for a different matching mode than the one used in the actual match call, causing fallback to the interpreter. The 8-bit PCRE2 library skips UTF validation in the interpreter because JIT already performed a check, but the JIT validation scope is smaller than the interpreter's lookbehind boundary. When processing invalid UTF sequences with unicode word-boundary operations (OP_UCP_WORD_BOUNDARY), unchecked data beyond the subject buffer is read and used as an unbounded index into the Unicode character database, causing a deterministic segmentation fault. Exploitation requires: the application uses pcre2_match() with PCRE2_UTF flag, a non-zero starting offset, a pattern containing lookbehind, and JIT compiled for a different matching mode than used in the call. The fix in PCRE2 10.48 adds a check ensuring JIT supports the requested matching mode before entering JIT validation, otherwise falling back to the interpreter with proper UTF validation.
Affected products
- PCRE2Project PCRE2 before 10.48
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: Fixed in PCRE2 10.48 release