PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).

• azl3 pcre2 10.42-3 on Azure Linux 3.0

See the Microsoft Security Update Guide for the update that applies to your product.

1. Sep 6, 2026 at 4:37 AM UTC
   Published by Microsoft Security Response Center

   The publication date reported by the vendor.

2. Sep 7, 2026 at 2:49 PM UTC
   Updated by Microsoft Security Response Center

   The vendor changed the advisory after it was first published.

3. Sep 8, 2026 at 7:05 AM UTC
   Added to SecurityAlert

   We collected the advisory from the official source.

4. Sep 11, 2026 at 2:10 PM UTC
   Confirmed at the source

   Our collector saw this advisory during a later source check.