CVE-2022-1586
pcre2: Out-of-bounds read in compile_xclass_matchingpath in pcre2_jit_compile.c
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · March 23, 2022
Updated · November 21, 2025
Description
An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-125 · Out-of-bounds Read