CVE-2025-58050: PCRE2: heap-buffer-overflow read in match_ref due to missing boundary restoration in SCS
The PCRE2 library is a set of C functions that implement regular expression pattern matching. In version 10.45, a heap-buffer-overflow read vulnerability exists in the PCRE2 regular expression matching engine, specifically within the handling of the (scs:...) (Scan SubString) verb when combined with (ACCEPT) in src/pcre2match.c. This vulnerability may potentially lead to information disclosure if the out-of-bounds data read during the memcmp affects the final match result in a way observable by the attacker. This issue has been resolved in version 10.46.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58050?
CVE-2025-58050 is classified as a high severity vulnerability due to the heap-buffer-overflow read issue which can lead to potential exploitation.
How do I fix CVE-2025-58050?
To fix CVE-2025-58050, upgrade the PCRE2 library to version 10.46 or later, which addresses the vulnerability.
What impact does CVE-2025-58050 have on my system?
CVE-2025-58050 can lead to unauthorized access or manipulation of memory, potentially causing crashes or data leakage.
Which versions of PCRE2 are affected by CVE-2025-58050?
CVE-2025-58050 affects PCRE2 versions from 10.45 to 10.46 exclusive; therefore, it is critical to update from version 10.45.
Is CVE-2025-58050 related to regular expression processing?
Yes, CVE-2025-58050 is specifically linked to a vulnerability in the regular expression matching engine of the PCRE2 library.