A null pointer dereference flaw exists in the check_and_merge_special_rules function within the re2c parser (files: src/parse/ast.cc) for all versions up to 4.4. This deficiency can cause the parser to crash when it encounters a malformed or unexpected rule structure, leading to a denial of service. No escalation of privileges or data disclosure is directly achievable from this code path, and the impact is confined to the local execution environment of the affected process.

The vulnerability affects the re2c utility developed by skvadrik. All releases up to and including version 4.4 are susceptible. The fix is identified by commit febeb977936f9519a25d9fbd10ff8256358cdb97, and any downstream builds that incorporate this patch will no longer hit the null pointer dereference. System administrators should verify that the installed re2c package incorporates this commit or a later release.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score is listed as less than 1%, reflecting a low probability of exploitation in the wild. The vulnerability is not catalogued in CISA’s Known Exploited Vulnerabilities list. Attackers can only exploit the flaw locally, which means that an attacker must be able to run code or control input streams on the host running re2c. Although the exploit has been published and can be used for local denial of Service, widespread automated exploitation is unlikely given the limited vector and low EPSS.