CVE-2026-103111 in PCRE2
Summary
by MITRE • 09/30/2026
PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The Perl Compatible Regular Expressions library version two, commonly referred to as PCRE2, serves as a foundational component for pattern matching in numerous software applications across the Linux ecosystem and beyond. A critical security flaw exists within versions prior to 10.49 that impacts systems utilizing Just-In-Time compilation features of the JIT API when processing attacker-controlled regular expressions. This vulnerability stems from an improper boundary check during the execution phase of compiled patterns, specifically leading to a heap-based out-of-bounds write condition. The root cause lies in the failure of the JIT compiler and executor to correctly validate memory offsets relative to the allocated buffer size under specific complex pattern scenarios involving backtracking or recursive structures managed by the JIT engine.
When an application accepts user-supplied input that is processed as part of a regular expression, it effectively grants control over the structure of the compiled bytecode if the attacker can influence the regex string itself. In this scenario, the PCRE2 library compiles the pattern using its Just-In-Time compiler to optimize performance for repeated matching operations. However, due to the logic error in memory management within the JIT execution path, the engine may calculate an incorrect destination address for a write operation. This miscalculation results in writing data beyond the bounds of the allocated heap buffer. The attacker can control both the offset and potentially parts of the payload being written, depending on how the surrounding application handles the regex input and subsequent memory operations.
The operational impact of this vulnerability is severe because it allows for arbitrary code execution with the privileges of the affected process. An out-of-bounds write provides an attacker with a mechanism to corrupt adjacent heap metadata or overwrite function pointers stored in nearby memory structures. By carefully crafting the regular expression, an adversary can manipulate these overwritten values to redirect program flow to shellcode injected into the same address space. This capability effectively bypasses standard memory protection mechanisms such as Data Execution Prevention and Address Space Layout Randomization if combined with additional exploitation techniques like heap spraying or information leaks. The vulnerability is particularly dangerous in web servers, mail filters, and log analyzers that process untrusted input using regex patterns without strict sanitization or length limits on the pattern itself.
From a classification perspective, this flaw aligns with CWE-787: Out-of-bounds Write, which describes writing data to a memory location beyond the intended boundary of a buffer. It also relates to CWE-20: Improper Input Validation, as the library fails to adequately validate constraints on regex complexity or length before JIT compilation and execution. In terms of attack vectors, this vulnerability facilitates exploitation through ATT&CK technique T1190: Exploit Public-Facing Application, where attackers leverage flaws in internet-facing services to gain initial access. It also touches upon T1203: Exploitation for Defense Evasion if used to bypass security controls by crashing or manipulating the application state.
Mitigation strategies primarily involve upgrading PCRE2 to version 10.49 or later, where these boundary checks have been corrected in both the JIT compiler and executor modules. For environments that cannot immediately upgrade, administrators should implement strict input validation policies on any data passed as regular expression patterns. This includes limiting pattern length, restricting special characters that trigger complex backtracking behaviors, and avoiding dynamic regex construction from untrusted sources whenever possible. Additionally, deploying runtime application self-protection tools or memory safety wrappers can help detect abnormal heap writes before they lead to full compromise. Organizations should also audit their codebases for direct usage of the PCRE2 JIT API with user-controlled patterns and consider switching to safer alternatives if high-risk exposure is unavoidable.