CyberRota Analysis
AI-GeneratedPCRE2 versions prior to 10.48 are vulnerable to an out-of-bounds write due to inadequate size checks when reusing cached workspace blocks in recursive DFA matching. This flaw can be exploited by attackers using specially crafted regular expressions or recursive patterns, potentially leading to arbitrary code execution or crashes. Organizations utilizing PCRE2 for pattern matching in applications should prioritize patching to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).