CVE-2025-58050 is a critical (CVSS 9.1) heap buffer over-read in PCRE2 10.45, the widely embedded regular expression library. It occurs when the scan substring verb is combined with ACCEPT, and may disclose memory. Version 10.46 fixes it. Check distribution packages and statically linked copies.
What's affected
PCRE2 version 10.45, per the record and the project advisory. The fixed version is 10.46.
The flaw is in src/pcre2_match.c, in the handling of the (*scs:...) verb together with (*ACCEPT).
PCRE2 is linked into many programs. A copy may sit inside a distribution package, a container base image or a statically built binary.
How to check if you're exposed
Start with the system library, then look for embedded copies.
pcre2-config --version
dpkg -l | grep -i pcre2
rpm -qa | grep -i pcre2
Static copies do not show up in package lists. For container images, scan the image contents rather than relying on the host. A scan of your dependency manifests and images will list PCRE2 wherever it appears as a package.
What to do now
- List the hosts, images and applications that include PCRE2, including statically linked ones.
- Upgrade to PCRE2 10.46 or install your distribution's patched build. Distributions may backport the fix under the old version number.
- Rebuild and redeploy container images and static binaries that bundle PCRE2.
- If an application lets outsiders supply regular expressions, consider whether it needs to accept the special verbs at all.
- Keep management and configuration interfaces off the internet and off guest networks.
- Record the firmware or build version of every affected device so you can match it to a fix when one is published.
Why it matters
The record describes an out-of-bounds read during a memory comparison inside the match engine. The combination of the scan substring verb with ACCEPT causes the engine to compare bytes beyond the buffer. If the extra data affects the final match result in a way an attacker can see, it can leak information.
The score reflects the library's reach as much as the bug. PCRE2 sits under web servers, text tools and language runtimes. The practical risk depends on whether an application passes pattern text from untrusted sources to the library, which many do not. That is where reachability analysis earns its keep.
The record classifies the weakness as CWE-122 (Heap-based Buffer Overflow) and CWE-125 (Out-of-bounds Read) and CWE-787 (Out-of-bounds Write).
Memory corruption bugs like this one come from copying more data into a fixed region than it can hold, or reading and writing at a position that was never checked. Depending on the target, the result ranges from a crash to a change in program behavior. Embedded and native code is hit hardest because there is usually no managed runtime to catch the mistake.
The lasting fix is a bounds check on every length or index that arrives from outside the component. Until that fix ships, the practical defense is to limit who can reach the vulnerable code path at all, which usually means keeping management interfaces and internal services off untrusted networks.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is my application affected if it only uses fixed patterns?
The record ties the flaw to specific pattern verbs. If no untrusted party can supply patterns, exposure is lower, but you should still patch the library.
Which version fixes it?
PCRE2 10.46. Version 10.45 is the affected release named in the record.
Sources
Last reviewed: 18 October 2026.
