Executive brief
PCRE2 is a widely-used regular expression library integrated into many applications and systems. When processing very large patterns through the pattern conversion API on 32-bit systems, PCRE2 can allocate an undersized buffer and write beyond its bounds, causing crashes or potential memory corruption. This affects applications that accept untrusted regex patterns for conversion.
Technical details
A 32-bit integer overflow vulnerability exists in the pcre2_pattern_convert() function's automatic output allocation path. The vulnerability occurs when PCRE2-managed output allocation is requested (non-NULL buffptr with *buffptr == NULL) on 32-bit platforms. The affected code multiplies the converted pattern length by PCRE2_CODE_UNIT_WIDTH (a bit width, not a byte count), causing the multiplication to overflow and result in allocation of only the internal header (~12 bytes) while the function then writes a much larger converted pattern beyond the allocated buffer. The vulnerability requires an attacker to supply a very large foreign-syntax pattern to be converted; pattern compilation and matching are not involved. Fixed in PCRE2 10.48 via proper byte-size calculation and allocation overflow checks.
Affected products
- PCRE2Project PCRE2 10.30 through 10.47
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: Fixed in version 10.48