Description

In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.9",
  "pubDate": "2026-09-11T05:16:38.697Z",
  "pubdate": "2026-09-11T05:16:38.697Z",
  "executiveSummary": "A vulnerability has been identified in the pcre2_serialize_encode function within PCRE2 versions prior to 10.48. This flaw allows for the disclosure of two bytes of sensitive information from the memory space during the serialization process.\nThe vulnerability is classified as an information disclosure issue. While the impact is limited to a small amount of data, it potentially facilitates further exploitation by exposing sensitive memory contents, such as pointers or internal structures, which could be leveraged to bypass memory protection mechanisms like ASLR.\nThe primary risk implication is the potential for an adversary to glean internal application memory states. Exploitation assumes the presence of a pre-existing unsafe execution environment where the attacker has sufficient access to trigger the serialization routine.\nThis issue affects all PCRE2 installations running versions earlier than 10.48 that utilize serialized compiled regex patterns. Mitigation necessitates an upgrade to the patched version of the PCRE2 library to eliminate the memory leakage path.",
  "technicalDetails": "The vulnerability resides within the pcre2_serialize_encode function, which is responsible for converting a compiled regular expression pattern into a byte stream suitable for storage or transmission. The root cause of the vulnerability is an implementation error during the serialization of the internal data structure, resulting in the failure to properly sanitize or clear specific memory regions prior to the encoding process.\nSpecifically, the function inadvertently includes two bytes of uninitialized or residual memory in the serialized output buffer. This behavior occurs because the serialization logic does not strictly account for alignment padding or structure member gaps, leading to the inclusion of adjacent memory contents that should remain confidential.\nThe attack flow requires an adversary to influence the application to call pcre2_serialize_encode on a crafted or controlled regular expression pattern. If the application is already operating in an environment where the adversary has control over the input patterns or the capability to inspect the serialized output, the leaked two bytes are extracted directly from the byte stream.\nWhile the exposure of two bytes may appear trivial in isolation, it provides an oracle for observing adjacent memory layout. In complex applications, this information can be systematically collected to reconstruct memory maps or reveal sensitive data stored in close proximity to the regex object in the heap. If the serialized data is transmitted over a network or stored in a persistent cache accessible to unauthorized users, the risk is compounded.\nThe affected component is the serialization logic of the PCRE2 library. The vulnerability is present in versions prior to 10.48. Exploitation does not require authentication to the PCRE2 library itself, but rather relies on the application context that utilizes the serialization feature. Because this involves reading memory state during the serialization of compiled regex structures, it typically requires the adversary to have an existing foothold or the ability to manipulate application inputs that trigger the serialization routine."
}