PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pcre2-syntaxUpgrade pcre2-utf16Upgrade pcre2-staticUpgrade pcre2-toolsUpgrade pcre2-develUpgrade pcre2-utf32Upgrade pcre2 | Oct 13, 2026 | Oct 12, 2026 |
| Alpine Linux | — | Upgrade pcre2 | Oct 2, 2026 | Sep 11, 2026 |
| Debian | — | Upgrade pcre2 | Sep 21, 2026 | Sep 11, 2026 |
| Oracle_linux | — | Upgrade pcre2-utf32Upgrade pcre2Upgrade pcre2-utf16Upgrade pcre2-staticUpgrade pcre2-develUpgrade pcre2-toolsUpgrade pcre2-syntax | Oct 22, 2026 | Sep 11, 2026 |
| Redhat_linux | — | Upgrade pcre2-debuginfoUpgrade pcre2-utf16Upgrade pcre2-utf32Upgrade pcre2-tools-debuginfoUpgrade pcre2-utf16-debuginfoUpgrade pcre2Upgrade pcre2-develUpgrade pcre2-utf32-debuginfoUpgrade pcre2-toolsUpgrade pcre2-debugsourceUpgrade pcre2-staticUpgrade pcre2-syntaxNo solution exists | Sep 15, 2026 | Sep 11, 2026 |
| Rocky_linux | — | Upgrade pcre2-toolsUpgrade pcre2-tools-debuginfoUpgrade pcre2-utf32Upgrade pcre2-debuginfoUpgrade pcre2-utf16-debuginfoUpgrade pcre2Upgrade pcre2-develUpgrade pcre2-utf16Upgrade pcre2-staticUpgrade pcre2-utf32-debuginfoUpgrade pcre2-debugsource | Oct 16, 2026 | Oct 14, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 22, 2026 | Sep 11, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub