Executive brief
PCRE2 is a widely-used regular expression library used by many applications and programming language runtimes. When a match data object from a previous pcre2_match() call using subject copying is reused with pcre2_jit_match(), the library fails to properly manage the previously-copied subject, resulting in a memory leak and invalid memory deallocation. This can cause application crashes or potentially enable remote code execution depending on how the library is used.
Technical details
The vulnerability is a use-after-free and double-free condition in pcre2_jit_match() that occurs when the function is called with a match data context object that was previously used by pcre2_match() with the PCRE2_COPY_MATCHED_SUBJECT flag set. The root cause is improper handling of the PCRE2_MD_COPIED_SUBJECT flag when reusing match context. The fast-path JIT matching function does not correctly check and manage the state of previously-allocated copied subject strings, leading to both a memory leak and an invalid free operation. The vulnerability requires an application to reuse match data objects across different matching functions with subject copying enabled. PCRE2 versions before 10.48 are affected; the fix was merged in August 2026 and released in version 10.48.
Affected products
- PCRE2Project PCRE2 before 10.48
Timeline
- 2026-09-11: disclosed
- 2026-08-31: patched: PCRE2 10.48 released