Executive brief
PCRE2 is a widely-used regular expression library used by many applications and services for pattern matching. When processing crafted invalid UTF-8 or UTF-16 input with specific pattern matching options enabled, PCRE2 can read memory before the allocated subject buffer, potentially causing application crashes and disclosure of sensitive heap data.
Technical details
This vulnerability is an out-of-bounds heap read (CWE-125) in the pcre2_match() interpreter occurring during backward character scans when PCRE2_MATCH_INVALID_UTF is enabled. The root cause is that certain code paths (variable-length lookbehind and extended-grapheme \X operations) use start_subject as their lower bound instead of check_subject, which marks the beginning of validated UTF content. When a subject begins with a UTF-8 continuation byte (0x80–0xBF) or UTF-16 low surrogate, the unbounded BACKCHAR macro can step past the buffer start. Exploitation requires the application to compile patterns with PCRE2_UTF and PCRE2_MATCH_INVALID_UTF, then match untrusted subjects. The 8-bit and 16-bit code paths are affected; 32-bit is unaffected. Impact is limited to process crash or information disclosure from adjacent heap memory; remote code execution is not demonstrated. Fixed in PCRE2 10.48 by applying check_subject bounds to affected backward-walk operations.
Affected products
- PCRE2Project PCRE2 10.34 through 10.47
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: Fixed in PCRE2 10.48