triggerable PCRE2 memory corruption path in precursor (CVE-2025-58050)

[dywzju09-blip]

Summary

I confirmed a triggerable PCRE2 vulnerability path in precursor on a 0.2.3 source snapshot/tag.
This is a real trigger, not a dependency-only match.

Trigger Point

• Public CLI regex matching flow
• Attacker-controlled regex pattern and subject input

Trigger Reason

• A crafted SCS/ACCEPT-style pattern reaches the vulnerable native matching path inside pcre2_match_8
• The project-owned public input path carries the input into PCRE2 matching logic

Trigger Evidence

• Pattern: (a)(b+)(*scs:(1)a(*ACCEPT))(\2)
• Subject: abbb
• Observed signal: AddressSanitizer: heap-buffer-overflow
• Native stack reaches pcre2_match.c / pcre2_match_8

Suggested Remediation

1. Upgrade the PCRE2 dependency chain to a version containing the fix for CVE-2025-58050.
2. Add a regression test using the exact pattern and subject above.
3. If user-supplied regex input is supported, temporarily reject this construct class or disable the risky PCRE2 path until the dependency update is released.