CVE-2025-58050

Name	CVE-2025-58050
Description	The PCRE2 library is a set of C functions that implement regular expression pattern matching. In version 10.45, a heap-buffer-overflow read vulnerability exists in the PCRE2 regular expression matching engine, specifically within the handling of the (scs:...) (Scan SubString) verb when combined with (ACCEPT) in src/pcre2_match.c. This vulnerability may potentially lead to information disclosure if the out-of-bounds data read during the memcmp affects the final match result in a way observable by the attacker. This issue has been resolved in version 10.46.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1112278

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
pcre2 (PTS)	bullseye	10.36-2+deb11u1	fixed
	bookworm	10.42-1	fixed
	trixie	10.46-1~deb13u1	fixed
	forky, sid	10.46-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
pcre2	source	bullseye	(not affected)
pcre2	source	bookworm	(not affected)
pcre2	source	trixie	10.46-1~deb13u1
pcre2	source	(unstable)	10.46-1	1112278

Notes

[bookworm] - pcre2 <not-affected> (Vulnerable code not present)
[bullseye] - pcre2 <not-affected> (Vulnerable code not present)
Introduced with: https://github.com/PCRE2Project/pcre2/commit/237899fd0e35709b4cf767e06a19e569e1888f74 (pcre2-10.45-RC1)
Fixed by: https://github.com/PCRE2Project/pcre2/commit/a141712e5967d448c7ce13090ab530c8e3d82254 (pcre2-10.46)