A critical out-of-bounds write vulnerability in PCRE2 allows unauthenticated attackers to potentially corrupt memory and impact system integrity.

This vulnerability occurs in the pcre2_dfa_match function when a cached workspace block is reused without proper size validation. It can be triggered by an unauthenticated attacker using a crafted regular expression or a recursive pattern combined with a restricted heap limit.

The vulnerability carries a CVSS score of 8.2, reflecting a high risk to system integrity. Successful exploitation could lead to memory corruption, potentially resulting in unauthorized code execution or application crashes, which poses a significant risk of service disruption and data compromise in environments relying on PCRE2 for pattern matching.

Immediate Action: Update PCRE2 to version 10.48 or later, as this release contains the necessary size checks to prevent the out-of-bounds write.

Proactive Monitoring: Monitor application logs for unexpected crashes or error patterns related to regex processing, which may indicate exploitation attempts.

Compensating Controls: If immediate patching is not feasible, restrict the use of user-supplied regular expressions and ensure that heap limits are configured conservatively to reduce the attack surface.

Public Exploit Available: Unknown

Given the potential for memory corruption and the high CVSS severity, organizations should prioritize updating all instances of PCRE2 to version 10.48. System administrators must verify that all dependent software packages are recompiled or linked against the updated library to ensure the fix is effectively applied across the environment.