CVE-2019-19204

HIGH

Oniguruma <6.9.4_rc2 - Buffer Overflow

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2019-19204. PoCs published by ManhNDd, tarantula-team.

AI-analyzed exploit summary The repository contains a functional proof-of-concept exploit for CVE-2019-19204, demonstrating a heap-based buffer over-read in Oniguruma's `fetch_interval_quantifier` function due to improper bounds checking. The PoC includes a C program that triggers the vulnerability, along with compilation instructions and a detailed crash log from AddressSanitizer.

Description

An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function fetch_interval_quantifier (formerly known as fetch_range_quantifier) in regparse.c, PFETCH is called without checking PEND. This leads to a heap-based buffer over-read.

Exploits (2)

nomisec WORKING POC 3 stars
by ManhNDd · poc
https://github.com/ManhNDd/CVE-2019-19204

The repository contains a functional proof-of-concept exploit for CVE-2019-19204, demonstrating a heap-based buffer over-read in Oniguruma's `fetch_interval_quantifier` function due to improper bounds checking. The PoC includes a C program that triggers the vulnerability, along with compilation instructions and a detailed crash log from AddressSanitizer.

Classification
Working Poc 100%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Oniguruma 6.x before 6.9.4_rc2
No auth needed
Prerequisites: Oniguruma library compiled with AddressSanitizer for detection
devstral-2 · analyzed Feb 19, 2026 Full analysis →
nomisec WORKING POC
by tarantula-team · poc
https://github.com/tarantula-team/CVE-2019-19204

The repository contains a functional proof-of-concept exploit for CVE-2019-19204, demonstrating a heap-based buffer over-read in Oniguruma's `fetch_interval_quantifier` function due to improper bounds checking. The PoC includes a C program that triggers the vulnerability, along with compilation instructions and a detailed crash log from AddressSanitizer.

Classification
Working Poc 100%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Oniguruma 6.x before 6.9.4_rc2
No auth needed
Prerequisites: Access to a system running vulnerable Oniguruma library
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (8)

Core 8
Core References
Exploit, Patch, Third Party Advisory x_refsource_misc
https://github.com/kkos/oniguruma/issues/162
Exploit, Third Party Advisory x_refsource_misc
https://github.com/ManhNDd/CVE-2019-19204
Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2019/12/msg00002.html
Third Party Advisory x_refsource_misc
https://github.com/tarantula-team/CVE-2019-19204
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4460-1/

Scores

CVSS v3 7.5
EPSS 0.0689
EPSS Percentile 93.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-125
Status published
Products (5)
debian/debian_linux 8.0
fedoraproject/fedora 30
fedoraproject/fedora 31
oniguruma_project/oniguruma 6.9.4 rc1
oniguruma_project/oniguruma 6.0.0 - 6.9.4
Published Nov 21, 2019
Tracked Since Feb 18, 2026