Heap-buffer-overflow WRITE in pcre2_compile_32 (OSS-Fuzz #488713937)

[sonupreetam]

Summary

OSS-Fuzz has identified a heap-buffer-overflow (WRITE 4) in pcre2_compile_32, reported as OSV-2026-343. The issue has been public since 2026-03-03 but does not appear to have a corresponding GitHub issue or fix.

Details

• Crash type: Heap-buffer-overflow WRITE 4
• Crash state: pcre2_compile_32 / pcre2_fuzzsupport.c
• OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=488713937
• OSV entry: https://osv.dev/vulnerability/OSV-2026-343
• Severity: HIGH
• Introduced in: commit 24f9d8d
• Affected versions: 10.45, 10.45-RC1, 10.46, 10.47

Questions

1. Is this issue already tracked internally via the OSS-Fuzz dashboard?
2. Is a fix in progress, or is this considered low priority given that the crash state references pcre2_fuzzsupport.c?

Context

This was surfaced by an OSV-based vulnerability scan of Homebrew packages. PCRE2 is a transitive dependency of many core tools (git, zsh, ripgrep, etc.), so visibility on the fix timeline would be appreciated.