CVE-2017-8399

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

PCRE2 before 10.30 has an out-of-bounds write caused by a stack-based buffer overflow in pcre2_match.c, related to a "pattern with very many captures."

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/98315Third Party Advisory, VDB Entry
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=783Third Party Advisory
https://security.gentoo.org/glsa/201710-09Third Party Advisory
https://vcs.pcre.org/pcre2/code/tags/pcre2-10.30/ChangeLog?revision=854&view=markup
https://vcs.pcre.org/pcre2?view=revision&revision=674Patch, Vendor Advisory
http://www.securityfocus.com/bid/98315Third Party Advisory, VDB Entry
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=783Third Party Advisory
https://security.gentoo.org/glsa/201710-09Third Party Advisory
https://vcs.pcre.org/pcre2/code/tags/pcre2-10.30/ChangeLog?revision=854&view=markup
https://vcs.pcre.org/pcre2?view=revision&revision=674Patch, Vendor Advisory

Timeline

Published: May 1, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-84008.8In SWFTools 0.9.2, an out-of-bounds write of heap data can occur in the function png_load() in lib/png.c:755. This issue can be triggered by CVE-2017-84016.5In SWFTools 0.9.2, an out-of-bounds read of heap data can occur in the function png_load() in lib/png.c:724. This issue can be triggered by CVE-2017-84028.8PivotX 2.3.11 allows remote authenticated users to execute arbitrary PHP code via vectors involving an upload of a .htaccess file.CVE-2017-84038.8360fly 4K cameras allow unauthenticated Wi-Fi password changes and complete access with REST by using the Bluetooth Low Energy pairing proce CVE-2017-84049.8An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video cli CVE-2017-84057.5An issue was discovered on D-Link DCS-1130 and DCS-1100 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connect CVE-2017-84068.8An issue was discovered on D-Link DCS-1130 devices. The device provides a crossdomain.xml file with no restrictions on who can access the we CVE-2017-84078.8An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of changing the administrative password f CVE-2017-84089.8An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video cli CVE-2017-84097.5An issue was discovered on D-Link DCS-1130 devices. The device requires that a user logging to the device to provide a username and password CVE-2017-84109.8An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connect CVE-2017-84118.8An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video cli