CVE-2019-20838
pcre: Buffer over-read in JIT when UTF is disabled and \X or \R has fixed quantifier greater than 1
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · June 15, 2020
Updated · October 9, 2026
Description
libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
Do not use more than one fixed quantifier with \R or \X with UTF disabled in PCRE or PCRE2, as these are the conditions needed to trigger the flaw.
CVSS / CWE
CVSS 3.1 · 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-125 · Out-of-bounds Read