Description

PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-09-30T05:16:45.863Z",
  "pubdate": "2026-09-30T05:16:45.863Z",
  "executiveSummary": "A critical out-of-bounds memory write vulnerability exists in PCRE2 versions prior to 10.49. The vulnerability originates within the Just-In-Time (JIT) compilation component when processing specifically crafted, attacker-controlled regular expressions. By manipulating the regex pattern combined with specific JIT API usage, an attacker can trigger memory corruption, resulting in an out-of-bounds write of arbitrary data.\nThe impact of this vulnerability is severe, potentially allowing for arbitrary code execution or significant memory corruption depending on the context of the host application. It affects any environment that utilizes the PCRE2 JIT compilation engine to process regex patterns provided by untrusted or external sources. Successful exploitation requires an attacker to exert influence over the regular expression pattern passed to the library. Organizations utilizing PCRE2 should prioritize upgrading to version 10.49 or newer to mitigate the risk of exploitation.",
  "technicalDetails": "The vulnerability resides in the PCRE2 JIT (Just-In-Time) compiler, which is designed to accelerate pattern matching by translating regular expression bytecodes into machine code. The flaw manifests when the JIT compiler improperly handles boundary checks or state tracking during the compilation of complex, attacker-influenced patterns.\nThe root cause involves a failure in the JIT compiler to adequately validate memory offsets or buffer boundaries when emitting machine instructions for specific regex constructs. When an attacker provides a maliciously crafted regular expression that invokes vulnerable JIT paths, the compiler may generate machine code that performs write operations outside the intended memory buffers.\nThe attack flow begins when an application accepts an unvalidated or attacker-supplied regex pattern. This pattern is passed to the PCRE2 JIT compilation API. During the JIT compilation phase, the engine calculates the required memory operations for the regex state machine. Due to the flaw, the generated JIT code includes instructions that bypass internal security bounds checks. When the compiled regex is subsequently executed against input data, these malicious JIT instructions perform an out-of-bounds write using arbitrary data provided by the attacker or dictated by the execution state.\nBecause the write operation is controlled by the attacker-supplied regex pattern and the JIT-generated machine code, an attacker can influence both the target memory address (within the scope of the JIT heap/buffer) and the data written. This type of memory corruption is typically leveraged to overwrite function pointers, internal structures, or stack data to gain control over the instruction pointer (IP/EIP/RIP).\nThis vulnerability does not strictly require local access if the application exposes a regex interface to remote clients (e.g., a web server filtering engine or a data processing service). No authentication is typically required if the vulnerable endpoint is accessible. The post-exploitation impact includes the potential for full system compromise, application crashing (Denial of Service), or arbitrary code execution under the security context of the process running the PCRE2 library."
}