CVE-2026-2903 Details
Description
A flaw has been found in skvadrik re2c up to 4.4. Impacted is the function check_and_merge_special_rules of the file src/parse/ast.cc. This manipulation causes null pointer dereference. The attack can only be executed locally. The exploit has been published and may be used. Patch name: febeb977936f9519a25d9fbd10ff8256358cdb97. It is suggested to install a patch to address this issue.
A null pointer dereference vulnerability has been identified in skvadrik re2c versions through 4.4. The issue arises in the check_and_merge_special_rules function within src/parse/ast.cc. This vulnerability can be exploited locally, leading to a segmentation fault as the program attempts to read a member variable from a null pointer during the determinization process. The vulnerability has been assigned CWE-476.
Users are advised to update to the latest version of re2c, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Feb 22, 2026CISA-ADP
Assessed Feb 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/oneafter/0202/blob/main/re/repro | [email protected] | Exploit |
| https://github.com/skvadrik/re2c/ | [email protected] | Vendor |
| https://github.com/skvadrik/re2c/commit/febeb977936f9519a25d9fbd10ff8256358cdb97 | [email protected] | Source CodeVendor |
| https://github.com/skvadrik/re2c/issues/571 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/skvadrik/re2c/issues/571#issuecomment-3837675101 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/?ctiid.347210 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/?id.347210 | [email protected] | AdvisoryExploitRemedy |
| https://vuldb.com/?submit.755030 | [email protected] | Technical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-404 | Improper Resource Shutdown or Release | [email protected] |
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| skvadrik re2c | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Feb 22, 2026 | New CVE Received | [email protected] |