CVE-2025-58050

What it actually does

Heap-buffer-overflow read in PCRE2 matching engine when processing (*scs:...) combined with (*ACCEPT) allows out-of-bounds memory access during memcmp, potentially exposing adjacent data if the result influences match outcome.

Why it matters to the business

Applications relying on PCRE2 for complex regular expressions face risk of limited information disclosure, which could expose sensitive strings or internal state in high-volume text processing workloads.

How an attack unfolds

An attacker crafts a malicious regular expression containing the (*scs:...) scan substring verb paired with (*ACCEPT), supplies attacker-controlled input that triggers the vulnerable code path in pcre2_match.c, and observes whether the out-of-bounds read alters the final match result to infer memory contents.

How to fix it

Upgrade pcre2project/pcre2 to commit a141712e5967d448c7ce13090ab530c8e3d82254 or later release 10.46; for libxml2 (Echo) update to 2.13.7-e1 or newer. Recompile and redeploy all dependent applications after the library update.

How to confirm the fix worked

Confirm PCRE2 version reports 10.46 or newer; run the library's test suite with patterns exercising (*scs:...) and (*ACCEPT); monitor for absence of crashes or sanitizer reports on boundary cases.

Typical attack path

1. Identify target application that uses PCRE2 for regex matching
2. Craft regex pattern using (*scs:...) and (*ACCEPT) verbs
3. Submit pattern and input designed to reach the vulnerable handler
4. Observe match result or side effects to extract leaked data

How to detect it

Review application logs for unusual regex compilation or matching failures; inspect core dumps or sanitizer output for heap-buffer-overflow reads involving pcre2_match; correlate with any observed anomalous match results on crafted patterns.

What your security team should do

• Prioritize upgrade of PCRE2 in all services handling untrusted regex or input
• Inventory applications and libraries linking against PCRE2 and schedule updates before any public exploit appears
• Add PCRE2 version checks to dependency scanning pipelines