CVE-2025-58050

Publication date 27 August 2025

Last updated 15 September 2025

Ubuntu priority

Medium

Why this priority?

The PCRE2 library is a set of C functions that implement regular expression pattern matching. In version 10.45, a heap-buffer-overflow read vulnerability exists in the PCRE2 regular expression matching engine, specifically within the handling of the (*scs:...) (Scan SubString) verb when combined with (*ACCEPT) in src/pcre2_match.c. This vulnerability may potentially lead to information disclosure if the out-of-bounds data read during the memcmp affects the final match result in a way observable by the attacker. This issue has been resolved in version 10.46.

Read the notes from the security team

Status

Package Ubuntu Release Status
pcre2 25.04 plucky
Vulnerable
24.04 LTS noble
Not affected
22.04 LTS jammy
Not affected
20.04 LTS focal
Not affected
18.04 LTS bionic
Not affected
16.04 LTS xenial
Not affected

Notes

mdeslaur

introduced in 10.45 with the following commit: https://github.com/PCRE2Project/pcre2/commit/237899fd0e35709b4cf767e06a19e569e1888f74

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
pcre2