CVE-2025-58050

CVE-2025-58050 is a critical heap-buffer-overflow read vulnerability in the PCRE2 regular expression matching engine (version 10.45 and earlier), specifically impacting the handling of the (*scs:...) verb with (*ACCEPT). This flaw could lead to information disclosure if the out-of-bounds data read affects the final match result in an observable way. With a CVSS score of 9.1 (CRITICAL), it is easily exploitable over the network with low attack complexity, potentially resulting in high confidentiality and availability impacts. While no public exploits or active exploitation have been observed, and it is not in CISA's KEV catalog, the vulnerability has garnered some community discussion, indicating awareness.