CVE-2016-3191
CriticalSummary
The compile_branch function in PCRE 8.x before 8.39 and in PCRE2 before 10.22 mishandles patterns containing the (*ACCEPT) substring in conjunction with nested parentheses. This allows remote attackers to execute arbitrary code or cause a denial of service via a crafted regular expression.
Risk Assessment
Organizations may be exposed to remote code execution or denial of service attacks, potentially leading to significant disruptions in system operations.
Recommendation
It is recommended to update to the latest version of PCRE or PCRE2 to mitigate this vulnerability and to review and validate the regular expressions used for security.
Original NVD description (English source)
The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested parentheses, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-3542.