CVE-2025-58050

Katalog CVE

CVSS 9.1 · Critical EPSS 0,80%

Kerentanan Heap-based Buffer Overflow pada pcre2. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

The PCRE2 library is a set of C functions that implement regular expression pattern matching. In version 10.45, a heap-buffer-overflow read vulnerability exists in the PCRE2 regular expression matching engine, specifically within the handling of the (*scs:...) (Scan SubString) verb when combined with (*ACCEPT) in src/pcre2_match.c. This vulnerability may potentially lead to information disclosure if the out-of-bounds data read during the memcmp affects the final match result in a way observable by the attacker. This issue has been resolved in version 10.46.

Rincian

Terbit di NVD

27 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow
CWE-125: Out-of-bounds Read
CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,80% peluang dieksploitasi; lebih tinggi dari 55,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-c2gv-xgf5-5cc2 exploit · advisory vendor
• https://github.com/PCRE2Project/pcre2/commit/a141712e5967d448c7ce13090ab530c8e3d82254 patch
• https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.46 release notes