CVE-2019-19012
CVSS v3
9.8
CRITICAL
EPSS Score
14.8 %
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression.
Technical details
- Published
- 2019-11-17
Frequently asked questions
What is CVE-2019-19012?
An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression.
Is CVE-2019-19012 actively exploited?
Active exploitation of CVE-2019-19012 has not been confirmed. The EPSS score is 14.8%, indicating the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2019-19012?
CVE-2019-19012 has a CVSS v3 base score of 9.8 (CRITICAL severity).
Is CVE-2019-19012 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 500 free checks/month · Free API key
Other 2019 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).