Pcre2
by Pcre
Source repositories
CVEs (6)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-89158 | Med | 0.42 | 6.5 | — | Sep 11, 2026 | PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write. | ||
| CVE-2026-89161 | Hig | 0.41 | 7.4 | — | Sep 11, 2026 | In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur. | ||
| CVE-2026-89157 | Med | 0.30 | 5.7 | — | Sep 11, 2026 | PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern. | ||
| CVE-2026-89160 | Low | 0.24 | 3.7 | — | Sep 11, 2026 | PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject. | ||
| CVE-2026-89162 | Low | 0.19 | 2.9 | — | Sep 11, 2026 | In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe. | ||
| CVE-2026-89156 | Low | 0.12 | 2.9 | — | Sep 11, 2026 | PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data. |
- risk 0.42cvss 6.5epss —
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.
- risk 0.41cvss 7.4epss —
In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.
- risk 0.30cvss 5.7epss —
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.
- risk 0.24cvss 3.7epss —
PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.
- risk 0.19cvss 2.9epss —
In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.
- risk 0.12cvss 2.9epss —
PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.