wxwidgets3.2 vendors a copy of pcre2 at:
3rdparty/pcre/src/pcre2_substring.c

This copy predates commit 8156b39 (August 9, 2026) which fixes an
integer overflow in pcre2_substring.c and pcre2_convert.c. The fix
adds an overflow guard:

if (size > ((PCRE2_SIZE_MAX - sizeof(pcre2_memctl)) / CU2BYTES(1)) - 1)
return PCRE2_ERROR_NOMEMORY;

No CVE has been assigned yet. The fix is public at:
https://github.com/PCRE2Project/pcre2/commit/8156b39

Please update the bundled pcre2 to the latest upstream version.

Found by: Attack of the Clones GSoC 2026 pipeline
(salsa.debian.org/rouca/gsoc2026)

Gajendra Nath Soren
gajendranath025@gmail.com

I'd argue we should be using the system pcre2 instead.  The upstream
build system seems to support this (I think upstream bundle all these
libraries for platforms which don't have them easily available as
packages rather than because they are patching them).

Looks like the default upstream configure behaviour is to probe for a
system library and fall back to the bundled copy, so my guess is we
aren't deliberately using the bundled copy but rather just missing a
build-dependency.  It would probably be a good idea to use
--with-pcre2=sys so it fails if the system copy is not found so missing
build-dependencies are an error.

Probably the same for other bundled libraries.

I've not touched the wxWidgets packaging for ages though, so Scott
should probably have a say here.

Cheers,
    Olly

In fact, we already do use the system pcre2 (you can check the build logs
and also notice that libwxbase3.2-1t64 depends on libpcre2-32-0).  So,
this is not really a bug since we're not using the bundled copy of pcre2.

Since we're already excluding other bundled libraries in d/copyright, we
can probably add pcre to this during our next upstream upload so it's
clearer that the bundled copy isn't being used.

Regards,
Scott

Control: tags -1 -security
Control: severity -1 wishlist

Sigh, I even thought to check this but only looked at the dependencies
of libwxgtk3.2-1t64 whereas the dependency would obviously be from base.

Makes sense - if it's not in the tree we build from we can't
accidentally use it, and people won't report vulnerabilities in
bundled copies to us if they are excluded at the repacking stage.

We should probably exclude all of 3rdparty if we can.  Both nanosvg and
catch seem to be packaged.  It looks like nanosvg support needs to be
enabled using --with-nanosvg at configure time so that's probably
unused.  It looks like upstream's configure only wants to use the
bundled catch.  Presumably it's only used for the testsuite and doesn't
actually get compiled into the packaged binaries though.

Anyway, this isn't actually a security bug, so untagging and lowering
the severity.

Cheers,
    Olly

We believe that the bug you reported is fixed in the latest version of
wxwidgets3.2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1146114@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Scott Talbert <swt@techie.net> (supplier of updated wxwidgets3.2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 02 Sep 2026 12:48:31 -0400
Source: wxwidgets3.2
Architecture: source
Version: 3.2.11+dfsg1-1
Distribution: unstable
Urgency: medium
Maintainer: wxWidgets Maintainers <team+wx@tracker.debian.org>
Changed-By: Scott Talbert <swt@techie.net>
Closes: 1146114 1146456
Changes:
 wxwidgets3.2 (3.2.11+dfsg1-1) unstable; urgency=medium
 .
   * Exclude 3rdparty/pcre when repacking upstream tarball (Closes: #1146114)
   * New repack to exclude 3rdparty/pcre
   * Patch image sample to fix autopkgtests w/ GCC 16 (Closes: #1146456)
Checksums-Sha1:
 ab43e041574aadd207c3f97d689209e55b4d56b0 3367 wxwidgets3.2_3.2.11+dfsg1-1.dsc
 02755a667580b76191e1648c13c2c009ab3d8372 17354912 wxwidgets3.2_3.2.11+dfsg1.orig.tar.xz
 5d6675ceb312bff1ff26c9aac52a7e9f3faf43bb 42224 wxwidgets3.2_3.2.11+dfsg1-1.debian.tar.xz
 75d83a71623f02df5bc2ce72c7f597493b6119ae 34837 wxwidgets3.2_3.2.11+dfsg1-1_amd64.buildinfo
Checksums-Sha256:
 25012954891ce2277e0932d2546d67d9811f604096acada7b484d3bcecfe6654 3367 wxwidgets3.2_3.2.11+dfsg1-1.dsc
 6a697f4e2ff58d82422d80cff0fce9a9d2b84e8fd590d0a401ad733f2a9ed416 17354912 wxwidgets3.2_3.2.11+dfsg1.orig.tar.xz
 f1fd8ae036e6151a54f8556ea4c337471d01d697fa663bbc868a8beee4c2483d 42224 wxwidgets3.2_3.2.11+dfsg1-1.debian.tar.xz
 30230e228b725d86f7c36f025a9f1222496bd3424298315f3ecfbf32aff0a97e 34837 wxwidgets3.2_3.2.11+dfsg1-1_amd64.buildinfo
Files:
 0459453ff7a6c07901d4eef9ceac73ce 3367 libs optional wxwidgets3.2_3.2.11+dfsg1-1.dsc
 11318f0916e6cfcc87c91d4df0efcf41 17354912 libs optional wxwidgets3.2_3.2.11+dfsg1.orig.tar.xz
 b239c2d04b4edd0a0eb797324af5d51e 42224 libs optional wxwidgets3.2_3.2.11+dfsg1-1.debian.tar.xz
 22e8b1c40a07db16814a56b0ab900804 34837 libs optional wxwidgets3.2_3.2.11+dfsg1-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJDBAEBCgAtFiEEbnQ09Yl9Q7F/zVe3U9W8ZLUjeKIFAmqYWIEPHHN3dEB0ZWNo
aWUubmV0AAoJEFPVvGS1I3iipy0P/RPtALpTqGDd3HvRohk2YeluCZoh+7u/dB2Z
LHqyixFTg8Kd12PHpvHF4ASWnpWpRghoEgEvfaXcKXxy2scI0iH+YpYjtkkTInf2
gEqTcmUsgN1yLy0RM/QiXBMyl+QdSCBRmQ9PFI9kR0fFJlRO47bpt4HDs5zgpYVw
hEtIgZFuxmbsPq0eAs2VOJUzN+Lreio9UbQb5SPcoYjL5rLlhGfh8wRU9cka/wGh
+i6Ee2/iazhLAWbjYaDgZ+HX0QmjF1/Z9ozBZk/Jyd3zTr1FHm7LyaCT6nnzJVtl
a2ziBBuTIuDg2PndWm/liblByHZ+8TcoBkGhW4kOyK/V7f/dDTHjzywyyuEGtrsg
5B4pv54vesoBkCso+ed1iWOVxMXVIgE4o4lrn0B+qK+tyJcIMGwi2SfYeobmpYUf
PB4cL5cI7IXVr/u49XqSbhR2cINXoMe3GVpkriK40n/Nb8glnu6N1CFhdkTuISNC
uoNRG/tjsBdQkDPFrBPJ2kZZXM9OD9ssw9ipb6DyTjP84h0xMIMXmQhIOlJpUuHK
EpR1tkt4jZseoRGNf/jcIbhXSOHL2rxg9GVw6c6IP4bfQJjW18aWv2E3hm7xOujf
P7PORQ5K+ydQ1az65wXenii8hUXyjaYprQeezamvMZvAUrJ33+hCoNUDRh6f3wUW
cu/2oZUN
=fi8u
-----END PGP SIGNATURE-----