CVE-2014-8964: Heap-based buffer overflow in PCRE 8.36 and earlier allows remote attackers to cause a denial of service (c...

Security readout for executives and security teams

CVE-2014-8964 is a memory corruption flaw in PCRE 8.36 and earlier. If a remote user can supply a malicious regular expression to software using PCRE, the process may crash. The public record also says there may be other unspecified impact, but the provided sources do not confirm exploitation or code execution. Exposure is most likely in servers, tools, or applications bundling or dynamically linking PCRE 8.36 or earlier, especially where untrusted users can submit regular expressions. Systems only using patched distribution packages are less likely to remain exposed. Prioritize remediation where PCRE is exposed through customer-controlled regex features or internet-facing services. For typical managed operating systems, this is usually a patch-verification task rather than an emergency response unless vulnerable versions remain deployed. Mitigation focus: Inventory PCRE versions in operating systems, containers, appliances, and bundled third-party software.; Apply vendor updates that address CVE-2014-8964 for each affected platform.; Check upstream or vendor guidance where package status is unclear..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.