CVE-2026-67550

Name of the Vulnerable Software and Affected Versions re2 versions prior to 1.25.2

Description The software validates lastIndex against the UTF-8 byte length of a subject but incorrectly uses it as a UTF-16 code-unit offset in the exec(), test(), match(), replace(), and split() functions. When a non-ASCII subject is used, an attacker-influenced lastIndex can trigger an out-of-bounds heap read, leading to an uncatchable process crash and potential limited heap information disclosure.

Recommendations Update to version 1.25.2.