PCRE2 Out-of-Bounds Write Vulnerability (10.30-10.47) Analysis & Fix in 10.48

PCRE2 Out-of-bounds Write Vulnerability Summary Vulnerability Overview Vulnerability Type: Out-of-bounds write Triggering Function: Trigger Condition: On 32-bit systems, when a very large pattern is passed in, allocates the output buffer based on an incorrect (too small) size calculation, resulting in an out-of-bounds write during subsequent writes. Impact: Heap memory corruption, which may cause process crashes or potential security issues. Scope of Impact Affected Versions: PCRE2 10.30 through 10.47 Fixed Version: 10.48 Affected Configurations: - 32-bit systems (64-bit systems are not affected) - Use of PCRE2-managed output buffer ( is NULL) - All widths are affected - No special option requirements Fix Upgrade: Upgrade PCRE2 to version 10.48 or later. Temporary Mitigation (Workaround): - Limit the size of the pattern passed to . - Or enable automatic output allocation mode. POC Code ```bash Compile PoC cc -O2 -o "BwCrc32" -w "C:\ -DPCRE2_BUILD_16=OFF \ -DPCRE2_BUILD_32=ON \ -DPCRE2_BUILD_UTF8=OFF \ -DPCRE2_BUILD_UNICODE=OFF \ -DPCRE2_BUILD_TESTS=OFF \ -DPCRE2_SUPPORT_JIT=OFF \ -DPCRE2_SHOW_REPORT=OFF \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DPCRE2_SUPPORT_LIBFAUX \ -DP

Goal Reached Thanks to every supporter — we hit 100%!

PCRE2 Out-of-Bounds Write Vulnerability (10.30-10.47) Analysis & Fix in 10.48

More from this source