CVE-2017-7186
At a glance
- Severity
- Not available
- EPSS
- EPSS 5.03 % · percentile 92 (2026-10-27)
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Modified
Description
libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access, and application crash) by triggering an invalid Unicode property lookup.
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | HIGH 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
Weaknesses (CWE)
European references
- ENISA EUVD · EUVD-2017-16224
- GCVE · GCVE-0-2017-7186
CERT-FR advisories
- CERTFR-2025-AVI-0969 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2018-AVI-293 — Multiples vulnérabilités dans Tenable Nessus Agent · cert.ssi.gouv.fr
- CERTFR-2018-AVI-288 — Multiples vulnérabilités dans Tenable Nessus · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:pcre:pcre:8.40:*:*:*:*:*:*:*cpe:2.3:a:pcre:pcre2:10.23:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| affected n/a |
References
- https://bugs.exim.org/show_bug.cgi?id=2052
- https://security.gentoo.org/glsa/201710-09
- https://vcs.pcre.org/pcre/code/trunk/pcre_internal.h?r1=1649&r2=1688&sortby=date
- https://vcs.pcre.org/pcre2/code/trunk/src/pcre2_internal.h?r1=600&r2=670&sortby=date
- https://vcs.pcre.org/pcre/code/trunk/pcre_ucd.c?r1=1490&r2=1688&sortby=date
- http://www.securityfocus.com/bid/97030
- https://blogs.gentoo.org/ago/2017/03/14/libpcre-invalid-memory-read-in-match-pcre_exec-c/
- https://vcs.pcre.org/pcre2/code/trunk/src/pcre2_ucd.c?r1=316&r2=670&sortby=date
- https://access.redhat.com/errata/RHSA-2018:2486
- https://security.gentoo.org/glsa/201710-25
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |