p PatchFirst

CVE-2025-58050

CVE-2025-58050 · PCRE2: heap-buffer-overflow read in match_ref due to missing boundary restoration in SCS

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The PCRE2 library is a set of C functions that implement regular expression pattern matching. In version 10.45, a heap-buffer-overflow read vulnerability exists in the PCRE2 regular expression matching engine, specifically within the handling of the (*scs:...) (Scan SubString) verb when combined with (*ACCEPT) in src/pcre2_match.c. This vulnerability may potentially lead to information disclosure if the out-of-bounds data read during the memcmp affects the final match result in a way observable by the attacker. This issue has been resolved in version 10.46.

CVSS 6.9 · Medium · EPSS 0.8% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • pcre2

    Versions
    • = 10.45: Affected

    No fix published

  • pcre2 Debian:13

    Versions
    • 10.45-1
    Affected ranges
    • ECOSYSTEM: < 10.46-1~deb13u1

    Update to 10.46-1~deb13u1

  • pcre2 Debian:14

    Versions
    • 10.45-1
    • 10.46-1~deb13u1
    Affected ranges
    • ECOSYSTEM: < 10.46-1

    Update to 10.46-1

  • pcre2 PyPI

    Versions
    • 0.1.0
    • 0.2.0
    • 0.3.0
    • 0.4.0
    • 0.5.0
    • 0.5.1
    • 0.5.2
    • 0.5.3
    • 0.6.0
    • 0.7.0
    Affected ranges
    • ECOSYSTEM: ≤ 10.45

    No fix published

Original sources

Check your server →