Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
pcre2project/pcre2
main @ ff92e0b
7
Fixes
11
CVEs
CRITICAL
Peak severity
33.3%
Coverage
Highlights
Memory Corruption: 2 prior fixes. Scrutinize any change in this area.
src/pcre2_match.c: most-fixed (3 issues). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Memory Corruption: Processing nested control verbs like (*ACCEPT) inside scan substring blocks (*scs) has repeatedly led to failures in restoring original subject pointers and boundary flags, resulting in critical heap-based memory corruption and potential out-of-bounds access. This is also documented in CVE-2025-58050.
Memory Safety: Backtracking operations during non-atomic lookbehind assertions inside the JIT compiler can fail to properly restore critical registers, such as STR_END, causing compilation logic failures and downstream memory safety bypasses.
Out-of-bounds Read: Miscalculations of compiled pattern code offsets, particularly when parsing Unicode properties or character classes via metadata-inspecting functions like pcre2_callout_enumerate(), can trigger arbitrary-length out-of-bounds memory reads.