Description
The PCRE2 library is a set of C functions that implement regular expression pattern matching. In version 10.45, a heap-buffer-overflow read vulnerability exists in the PCRE2 regular expression matching engine, specifically within the handling of the (*scs:...) (Scan SubString) verb when combined with (*ACCEPT) in src/pcre2_match.c. This vulnerability may potentially lead to information disclosure if the out-of-bounds data read during the memcmp affects the final match result in a way observable by the attacker. This issue has been resolved in version 10.46.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PCRE2Project | pcre2 | = 10.45 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pcre2 | 10.46-1 | — |
| Debian 13 | pcre2 | 10.46-1~deb13u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.04 | pcre2 | 10.45-1ubuntu0.1 | USN-7777-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | pcre2 | 10.45-160000.3.1 | SUSE-SU-2026:21172-1 |
| SLES 16.0 | pcre2 | 10.45-160000.3.1 | SUSE-SU-2026:21172-1 |
| SLE Micro 6.2 | pcre2 | 10.45-160000.3.1 | SUSE-SU-2026:21094-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | pcre2 | 10.46-1.1 | openSUSE-SU-2025:15501-1 |
| openSUSE Leap 16.0 | pcre2 | 10.45-160000.3.1 | openSUSE-SU-2026:20512-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | pcre2 | 10.46-r0 | — |
| Alpine v3.23 | pcre2 | 10.46-r0 | — |
| Alpine v3.22 | pcre2 | 10.46-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pcre2 | <= 10.45 | — | PYSEC-2025-259 |
Advisories 9
- WID-SEC-2026-2448 Oracle Utilities Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2026
- WID-SEC-2025-2034 Erlang/OTP: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 7, 2026
- WID-SEC-2026-1723 Oracle Communications Unified Assurance: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 28, 2026
- openSUSE-SU-2026:20512-1 Security update for pcre2 SUSE / openSUSE Security Updates · Apr 22, 2026
- SUSE-SU-2026:21172-1 Security update for pcre2 SUSE / openSUSE Security Updates · Apr 22, 2026
- WID-SEC-2026-1194 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- SUSE-SU-2026:21094-1 Security update for pcre2 SUSE / openSUSE Security Updates · Apr 17, 2026
- openSUSE-SU-2025:15501-1 libpcre2-16-0-10.46-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- USN-7777-1 pcre2 vulnerability Ubuntu Security Notices (USN) · Oct 13, 2025