PCRE2 versions prior to 10.48 permit an out‑of‑bounds write during a pcre2_dfa_match operation. The bug arises when a cached workspace block used in recursive DFA matching is reused without a size check, even though a freshly allocated block for the same purpose includes such a check. The effect is memory corruption, which can be leveraged by an attacker to execute arbitrary code. The description indicates that this requires either an attacker‑controlled regular expression or the use of a recursive pattern together with a small heap limit that can be set through the API. The vulnerability is therefore an exploitable memory corruption that can lead to remote code execution if a malicious input is processed by a vulnerable library.

The affected product is PCRE2, a commonly used regular expression engine used in many programming languages and applications. Versions of PCRE2 prior to 10.48 are vulnerable; any installation of older PCRE2 that performs DFA matching with recursive patterns is at risk. No specific vendor release notes are included, but the fix is available in release 10.48 as referenced on the project’s repository.

The CVSS score of 8.2 classifies this as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The nature of the out‑of‑bounds write suggests that an attacker would need to supply a crafted regular expression that triggers the recursive DFA path and potentially set a small heap limit via the API. Because the vulnerability is tied to specific regex constructs and configuration knobs, exploitation is non‑trivial but attainable by an attacker who can influence the input to a vulnerable library.