CVE-2025-58050
📋 TL;DR
A heap-buffer-overflow read vulnerability in PCRE2 library version 10.45 allows attackers to read out-of-bounds memory when processing specific regular expression patterns containing (*scs:...) and (*ACCEPT) verbs. This could lead to information disclosure if the memory read affects match results observable to attackers. Any software using PCRE2 10.45 is affected.
💻 Affected Systems
- PCRE2 library
- Software using PCRE2 10.45 (e.g., PHP, Apache, Nginx, various parsers)
📦 What is this software?
Pcre2 by Pcre
⚠️ Risk & Real-World Impact
Worst Case
Sensitive memory contents (passwords, keys, session data) could be disclosed to attackers through carefully crafted regular expressions.
Likely Case
Information disclosure of adjacent heap memory, potentially revealing application state or sensitive data fragments.
If Mitigated
Limited impact if memory protections (ASLR, heap canaries) are effective, but information leakage still possible.
🎯 Exploit Status
Exploitation requires crafting specific regex patterns and understanding target application's regex usage.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.46
Vendor Advisory: https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-c2gv-xgf5-5cc2
Restart Required: Yes
Instructions:
1. Download PCRE2 10.46 from official repository. 2. Compile and install following standard build procedures. 3. Recompile any applications linking against PCRE2. 4. Restart affected services.
🔧 Temporary Workarounds
Input Validation
allSanitize or reject regex patterns containing (*scs:...) and (*ACCEPT) verbs before processing.
🧯 If You Can't Patch
- Implement WAF rules to block regex patterns containing (*scs:...) and (*ACCEPT) verbs
- Isolate vulnerable systems from untrusted networks and limit regex processing to trusted inputs only
🔍 How to Verify
Check if Vulnerable:
Check PCRE2 version: pcre2-config --version or check library files for version 10.45Check Version:
pcre2-config --version || strings /usr/lib*/libpcre2*.so | grep '^PCRE2_VERSION'Verify Fix Applied:
Verify version is 10.46 or higher using pcre2-config --version📡 Detection & Monitoring
Log Indicators:
- Application crashes or abnormal termination when processing regex patterns
- Memory access violation errors in application logs
Network Indicators:
- Unusual regex patterns in input data
- Repeated regex processing attempts with similar patterns
SIEM Query:
source="application.logs" AND ("segmentation fault" OR "heap overflow" OR "memory violation") AND process="*pcre*"🔗 References
- https://github.com/PCRE2Project/pcre2/commit/a141712e5967d448c7ce13090ab530c8e3d82254
- https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.46
- https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-c2gv-xgf5-5cc2
- https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-c2gv-xgf5-5cc2
