Heap Buffer Overflow Vulnerability in PCRE2 Package
Summary
OSV-2026-145: Heap-buffer-overflow in pcre2_compile_32. Affects pcre2 versions >= 05aafb2e308e5529e3fd5fed45bae253eebed75b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PCRE2 (Perl Compatible Regular Expressions) is a widely used library that provides a set of functions for implementing regular expression pattern matching. It is known for its performance and flexibility, making it a popular choice for developers needing regex capabilities in their applications. However, like many software libraries, it is susceptible to vulnerabilities that can compromise the integrity and security of applications that depend on it.
Vulnerability Detail
The vulnerability identified as a heap-buffer-overflow in the PCRE2 library occurs during the execution of the pcre2_compile_32 function. This issue was reported by OSS-Fuzz and is characterized by an attempt to write beyond the allocated memory buffer, which can lead to application crashes or potential exploitation by attackers. The specific crash state indicates that the overflow occurs in the pcre2_fuzzsupport.c file, which is part of the fuzz testing support for the library. The severity of this vulnerability is classified as HIGH, emphasizing the need for immediate attention.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the pcre2_compile_32 function until the patch is applied. Additionally, implementing input validation to ensure that data passed to this function does not exceed expected limits may help mitigate the risk of exploitation.
Conclusion
The heap buffer overflow vulnerability in the PCRE2 package poses a significant risk to applications that utilize this library for regular expression processing. It is crucial for developers to update to the latest patched version and consider implementing workarounds until the update can be applied. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for pcre2 →
FAQ
A heap buffer overflow occurs when a program writes more data to a buffer located on the heap than it can hold, leading to memory corruption and potential security vulnerabilities.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to application crashes, data corruption, or unauthorized access to sensitive information, posing significant security risks.
Yes, a patched version of the PCRE2 library is available. Users should update to the latest version to mitigate this vulnerability.
If an immediate update is not possible, consider implementing input validation and avoiding the use of the vulnerable function as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for pcre2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
