Description
A flaw has been found in skvadrik re2c up to 4.4. Impacted is the function check_and_merge_special_rules of the file src/parse/ast.cc. This manipulation causes null pointer dereference. The attack can only be executed locally. The exploit has been published and may be used. Patch name: febeb977936f9519a25d9fbd10ff8256358cdb97. It is suggested to install a patch to address this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| skvadrik | re2c | 4.0, 4.1, 4.2, 4.3, 4.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | re2c | 4.5.1-1 | — |
| Debian 13 | re2c | No fix yet | — |
| Debian 12 | re2c | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | re2c | No fix yet | — |
| Ubuntu 26.04 LTS | re2c | No fix yet | — |
| Ubuntu 25.10 | re2c | No fix yet | — |
| Ubuntu 24.04 LTS | re2c | No fix yet | — |
| Ubuntu 22.04 LTS | re2c | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | re2c | 4.6-2.1 | openSUSE-SU-2026:12506-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | re2c | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | re2c | No fix yet | — |
Advisories 1
- openSUSE-SU-2026:12506-1 re2c-4.6-2.1 on GA media SUSE / openSUSE Security Updates · Nov 10, 2026
References
- VDB-347210 | skvadrik re2c ast.cc check_and_merge_special_rules null pointer dereference vdb-entry technical-description
- VDB-347210 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #755030 | skvadrik re2c 04f1424 NULL Pointer Dereference third-party-advisory
- https://github.com/skvadrik/re2c/issues/571 issue-tracking
- https://github.com/skvadrik/re2c/issues/571#issuecomment-3837675101 issue-tracking
- https://github.com/oneafter/0202/blob/main/re/repro exploit
- https://github.com/skvadrik/re2c/commit/febeb977936f9519a25d9fbd10ff8256358cdb97 patch
- https://github.com/skvadrik/re2c/ product