The PCRE2 library is a set of C functions that implement regular expression pattern matching. In version 10.45, a heap-buffer-overflow read vulnerability exists in the PCRE2 regular expression matching engine, specifically within the handling of the (*scs:...) (Scan SubString) verb when combined with (*ACCEPT) in src/pcre2_match.c. This vulnerability may potentially lead to information disclosure if the out-of-bounds data read during the memcmp affects the final match result in a way observable by the attacker. This issue has been resolved in version 10.46.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-5905c468d2 advisory.

    Fix for CVE-2025-58050

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 25.04 host has packages installed that are affected by a vulnerability as referenced in the USN-7777-1 advisory.

    It was discovered that PCRE2 incorrectly handled the Scan SubString verb. An attacker could possibly use     this issue to cause applications using PCRE2 to expose sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the b51a4121-9607-11f0-becf-00a098b42aeb advisory.

    security-advisories@github.com reports:
    The PCRE2 library is a set of C functions that implement regular             expression pattern matching.  In version 10.45, a heap-buffer-overflow             read vulnerability exists in the PCRE2 regular expression matching             engine, specifically within the handling of the (*scs:...) (Scan             SubString) verb when combined with (*ACCEPT) in src/pcre2_match.c.
            This vulnerability may potentially lead to information disclosure             if the out-of-bounds data read during the memcmp affects the final             match result in a way observable by the attacker.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
271785	Fedora 42 : pcre2 (2025-5905c468d2)	Nessus	Fedora Local Security Checks	medium
265970	Ubuntu 25.04 : PCRE2 vulnerability (USN-7777-1)	Nessus	Ubuntu Local Security Checks	medium
265682	FreeBSD : PCRE2: heap-buffer-overflow read in match_ref due to missing boundary restoration in SCS (b51a4121-9607-11f0-becf-00a098b42aeb)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2025-58050

medium

Tenable Plugins

medium

medium

medium