CVE-2026-2903: skvadrik re2c Use-After-Free Vulnerability

CVE-2026-2903 Overview

A null pointer dereference vulnerability has been discovered in skvadrik re2c versions up to 4.4. The flaw exists in the check_and_merge_special_rules function within the file src/parse/ast.cc. When exploited, this vulnerability can cause a denial of service condition through null pointer dereference. The attack requires local access to the system to execute.

Critical Impact

Local attackers can trigger a null pointer dereference in re2c's AST parsing functionality, potentially causing application crashes and denial of service when processing malformed input files.

Affected Products

• skvadrik re2c versions up to 4.4

Discovery Timeline

• 2026-02-22 - CVE CVE-2026-2903 published to NVD
• 2026-02-23 - Last updated in NVD database

Technical Details for CVE-2026-2903

Vulnerability Analysis

This vulnerability affects the re2c lexer generator tool, specifically within the abstract syntax tree (AST) processing module. The check_and_merge_special_rules function in src/parse/ast.cc fails to properly validate pointer references before dereferencing them when processing special rules. When actions are used without corresponding rules, the function attempts to access a null pointer, leading to a crash.

The vulnerability is classified under CWE-404 (Improper Resource Shutdown or Release), though the primary manifestation is a null pointer dereference that results in denial of service. The local attack vector means an attacker would need to craft a malicious input file and have the victim process it with a vulnerable version of re2c.

Root Cause

The root cause lies in insufficient null pointer validation within the check_and_merge_special_rules function. The code previously attempted to access action arrays and generate error messages for conditions without properly verifying that the underlying rule structures were valid and non-null. The vulnerable code path would access g.action[0]->loc when rules were empty, without first ensuring the action pointer was valid.

Attack Vector

An attacker with local access can exploit this vulnerability by crafting a specially formatted re2c input file that triggers the vulnerable code path. When the re2c tool processes this malicious input, the null pointer dereference occurs in the AST parsing phase, causing the application to crash. This can be leveraged for denial of service attacks against build systems or development environments that use re2c for lexer generation.

// Security patch from src/parse/ast.cc
// Source: https://github.com/skvadrik/re2c/commit/febeb977936f9519a25d9fbd10ff8256358cdb97

                 all_conds_have_it = false; \
             } else if (g.name == STAR_COND) { \
                 star_action = g.action[0]; \
-            } else if (g.rules.empty()) { \
-                RET_FAIL(msg.error(g.action[0]->loc, \
-                    "%s action for non-existing condition `%s` found", \
-                    str, g.name.c_str())); \
             } \
         } \
         if (star_action && all_conds_have_it) { \

The patch removes the problematic code block that attempted to access g.action[0]->loc when g.rules.empty() was true, eliminating the null pointer dereference condition.

Detection Methods for CVE-2026-2903

Indicators of Compromise

• Unexpected crashes or segmentation faults when running re2c on input files
• Core dumps generated by re2c processes with stack traces pointing to check_and_merge_special_rules in src/parse/ast.cc
• Build system failures in projects using re2c for lexer generation with suspicious input files

Detection Strategies

• Monitor for abnormal termination signals (SIGSEGV) from re2c processes in development and build environments
• Implement file integrity monitoring on re2c input files to detect unauthorized modifications
• Review build logs for repeated re2c crashes that may indicate exploitation attempts

Monitoring Recommendations

• Enable crash dump collection for development tools including re2c to capture forensic data
• Set up alerting for repeated crashes of re2c processes within short time windows
• Monitor version control systems for introduction of suspicious .re or re2c input files

How to Mitigate CVE-2026-2903

Immediate Actions Required

• Upgrade re2c to a version that includes commit febeb977936f9519a25d9fbd10ff8256358cdb97 or later
• Review and validate all re2c input files in your build pipeline for suspicious content
• Restrict write access to re2c input files to trusted developers only

Patch Information

The vulnerability has been addressed in the official re2c repository with commit hash febeb977936f9519a25d9fbd10ff8256358cdb97. Organizations using affected versions should update to the patched version immediately. The patch removes the vulnerable code path that could trigger the null pointer dereference when processing rules with actions but no corresponding rule definitions.

For additional details, refer to:

• GitHub Issue #571
• Security Patch Commit
• VulDB Advisory

Workarounds

• Isolate re2c processing in sandboxed environments to limit the impact of potential crashes
• Implement input validation on re2c files before processing, checking for malformed rule structures
• Use containerized build environments to contain potential denial of service conditions

# Example: Update re2c to patched version from source
git clone https://github.com/skvadrik/re2c.git
cd re2c
git checkout febeb977936f9519a25d9fbd10ff8256358cdb97
mkdir build && cd build
cmake ..
make && sudo make install