CVE-2019-20454

An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode

Medium · published February 14, 2020

CVSS v3.0
5.1
EPSS
2%
Percentile
75.0
In the wild
Unconfirmed
What it is

An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c.

The record
Technical detail
CVSS v3.0
5.1 · MEDIUM
Vector
CVSS:3.0/AC:H/AV:L/A:H/C:N/I:N/PR:N/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.01561 · 75.0th percentile
Published
2020-02-14T00:00Z
EPSS history
Timeline
  • 14 FEB 00:00Z
    An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode
    cvelistv5