Bug 2531860

Summary: CVE-2026-86145 pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions [fedora-all]
Product: [Fedora] Fedora Reporter: Ganesh <gnaik>
Component: pcre2Assignee: Daniel Handzus <dhandzus>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: high    
Version: rawhideCC: artem, db-sig, ljavorsk, ndavidov
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["18a1c26d-2f97-492a-86a7-d875d7529cc5"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2528993    
Attachments:
Description Flags
upstream patch none

Description Ganesh 2026-09-11 12:14:14 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).
Comment 1 Fedora Admin user for bugzilla script actions 2026-09-30 15:10:47 UTC 
This package has changed maintainer in Fedora. Reassigning to the new maintainer of this component.
Comment 2 Artem Dinaburg 2026-10-16 19:44:59 UTC 
Hello,

I'd like to offer a backport of the CVE-2026-86145 fix (GHSA-3r4p-g7gg-ppmf) for the stable
releases. Fedora 43, 44 and 45 all ship PCRE2 10.47, which is affected; upstream fixed it in
10.48, and the Rawhide rebase to 10.49 in PR 36 already includes the fix:
https://src.fedoraproject.org/rpms/pcre2/pull-request/36

The bug is in DFA matching (pcre2_dfa_match() only; pcre2_match() and JIT are not affected).
A crafted pattern that combines nested assertions and recursion with a low heap limit, which
the pattern itself can set with (*LIMIT_HEAP=...), makes a later recursion reuse a cached
workspace block that is too small. The result is a heap out-of-bounds write, so any
application that runs untrusted patterns through pcre2_dfa_match() can at least be crashed.

The attached patch is upstream commit c932e70451ea, unchanged (upstream also applied it to
its 10.47 release branch). It checks the size of a reused workspace block, makes the
heap-limit clamp overflow-safe, adds assertions at the recursion sites, and adds the upstream
regression test to testinput6, so it runs during %check.

The patch applies cleanly, without fuzz, to the current f43 and f44 sources. F45 has the same
tarball and patches, so it should apply there too, but I have not checked that branch
separately. On a Fedora 44 source build, the upstream test crashed without the patch and
returned the expected "heap limit exceeded" error with it. I have not done a Mock or full RPM
build.

AI assistance was used to prepare this patch and its validation. The resulting
changes and validation results were reviewed by a human.

Could you consider it for the f43/f44 (and f45, if appropriate) updates? I'm happy to fit it
into whatever you have planned alongside the Rawhide rebase.

Thanks!
Comment 3 Artem Dinaburg 2026-10-16 19:45:40 UTC 
Created attachment 2161371 [details]
upstream patch