PT-2026-21404 · Re2C · Re2C

Oneafter · Published 2026-02-22 · Updated 2026-02-26 · CVE-2026-2903

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions re2c versions up to 4.4

Description A flaw exists in re2c that can lead to a null pointer dereference. The issue is located in the check and merge special rules function within the src/parse/ast.cc file. This manipulation can be exploited locally. An exploit has been published and may be used.

Recommendations Install the patch febeb977936f9519a25d9fbd10ff8256358cdb97 to address this issue.

Exploit

Fix

NULL Pointer Dereference

Improper Resource Release

Weakness Enumeration

CWE-476

CWE-404

Related Identifiers

AZL-78270

AZL-78273

CVE-2026-2903

ECHO-3D92-841B-34E6

Affected Products

Re2C

References · 24

• 🔥 https://github.com/oneafter/0202/blob/main/re/repro · Exploit
• https://github.com/skvadrik/re2c/commit/febeb977936f9519a25d9fbd10ff8256358cdb97 · Patch
• https://osv.dev/vulnerability/CVE-2026-2903 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-2903 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-78273 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-2903 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-2903 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2026-2903 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-2903 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-78270 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2903 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-2903 · Vendor Advisory
• https://github.com/skvadrik/re2c/issues/571 · Note
• https://github.com/skvadrik/re2c/issues/571#issuecomment-3837675101 · Note
• https://t.me/cveNotify/152745 · Telegram Post