Vulnerability · Published Aug 27, 2025 · Assigned by GitHub_M
CVE-2025-58050PCRE2: heap-buffer-overflow read in match_ref due to missing boundary restoration in SCS
Medium 6.9
In plain English
A medium-severity out-of-bounds read in pcre2 from PCRE2Project. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The PCRE2 library is a set of C functions that implement regular expression pattern matching. In version 10.45, a heap-buffer-overflow read vulnerability exists in the PCRE2 regular expression matching engine, specifically within the handling of the (*scs:...) (Scan SubString) verb when combined with (*ACCEPT) in src/pcre2_match.c. This vulnerability may potentially lead to information disclosure if the out-of-bounds data read during the memcmp affects the final match result in a way observable by the attacker. This issue has been resolved in version 10.46.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.22 | pcre2 | 10.46-r0 | ALPINE-CVE-2025-58050 |
| Alpine:v3.23 | pcre2 | 10.46-r0 | ALPINE-CVE-2025-58050 |
| Alpine:v3.24 | pcre2 | 10.46-r0 | ALPINE-CVE-2025-58050 |
| Debian:13 | pcre2 | 10.46-1~deb13u1 | DEBIAN-CVE-2025-58050 |
| Debian:14 | pcre2 | 10.46-1 | DEBIAN-CVE-2025-58050 |
| PyPI | pcre2 | no fix listed | PYSEC-2025-259 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PCRE2Project | pcre2 | = 10.45 |
Weakness: CWE-125, CWE-122 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:L