CVE-2017-9225: oniguruma_project oniguruma Out-of-bounds Write
Vulnerability summary
CVE-2017-9225 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in oniguruma_project oniguruma. EPSS estimates a 3.08% chance of exploitation in the next 30 days, higher than 87.6% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1Timeline
- 24-05-2017PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds write in onigenc_unicode_get_case_fold_codes_by_str() occurs during regular expression compilation. Code point 0xFFFFFFFF is not properly handled in unicode_unfold_key(). A malformed regular expression could result in 4 bytes being written off the end of a stack buffer of expand_case_fold_string() during the call to onigenc_unicode_get_case_fold_codes_by_str(), a typical stack buffer overflow.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
3.08%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
No change 0.00 pp
From 3.08% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundOniguruma
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- libonig< 6.1.3-2
Oniguruma_project1 product
- onigurumaEOL6.2.0
Php1 product
- php≤ 7.1.5
Ruby-lang1 product
- ruby≤ 2.4.1
4 vendors · 4 products
References
3 links- github.com/kkos/oniguruma/commit/166a6c3999bf06b4de0ab4ce6b088a468cc4029fX Refsource CONFIRMPatchThird Party Advisory
