CVE-2022-1586 is a critical out-of-bounds read vulnerability in the PCRE2 library, specifically within the JIT-compiled regular expression engine's handling of unicode property matching during case-less operations. This flaw affects various products including Debian, Fedora Project, NetApp, and Red Hat. With a CVSS score of 9.1 (Critical), this vulnerability can be exploited remotely without user interaction, potentially leading to high impact on confidentiality and availability. The attack complexity is low. Currently, there is no public exploit code available (Metasploit, Nuclei, ExploitDB), and it is not listed on the CISA KEV catalog, indicating no active exploitation. However, the vulnerability has garnered significant community discussion, with 10 mentions.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 10.40CPE matchmatch criteria | cpe:2.3:a:pcre:pcre2:*:*:*:*:*:*:*:* | ||
35CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | ||
36CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.
May 10, 2022pcre2: Out-of-bounds read in compile_xclass_matchingpath in pcre2_jit_compile.c
Mar 23, 2022