CVE-2026-2903: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-2903 is a NULL pointer dereference vulnerability in skvadrik re2c, a lexer generator for C, C++, and other languages, affecting versions up to 4.4. The flaw resides in the check_and_merge_special_rules function within src/parse/ast.cc, and is triggered when actions (such as post-rules) are used in a grammar block that contains no matching rules, causing re2c to proceed to determinization with a null root TNFA state. It was reported on February 2, 2026, and published to NVD on February 22, 2026. The vulnerability carries a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 4.8 (Medium) (Feedly, re2c Issue #571).

The root cause is classified as CWE-476 (NULL Pointer Dereference) and CWE-404 (Improper Resource Shutdown or Release). When a re2c grammar block contains special rule actions (e.g., !post_rule) but no actual lexer rules, the check_and_merge_special_rules function in src/parse/ast.cc failed to detect this invalid state for non-conditioned blocks (the check existed only for blocks with start conditions). As a result, determinization proceeded with a null root TNFA state, causing a segmentation fault inside re2c::closure_leftmost_dfs at src/dfa/closure_leftmost.h:27 when the code attempted to dereference a NULL pointer at offset 0x18. The fix (commit febeb97) adds a validation loop after rule merging that emits an error and aborts before determinization if any grammar block has actions but no rules (re2c Commit, re2c Issue #571). A proof-of-concept .re input file is publicly available (PoC Repro).

Successful exploitation causes re2c to crash with a segmentation fault (SIGSEGV), resulting in a denial of service for the re2c process. Since re2c is a developer tool used at build time to generate lexers, the impact is limited to availability of the build toolchain rather than production runtime systems. There is no confidentiality or integrity impact, and no potential for lateral movement or remote code execution (Feedly, re2c Issue #571).

A proof-of-concept exploit (a crafted .re input file) has been publicly disclosed and is available on GitHub (PoC Repro). Exploitation requires local access and low privileges — an attacker must be able to supply a malicious .re file to the re2c binary. The EPSS score is approximately 0.013% (0.000130), indicating very low probability of widespread exploitation. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog (Feedly).

1. Craft a malicious .re file: Create a re2c grammar file that includes a special rule action (e.g., !post_rule { ... }) inside a block that contains no actual lexer rules. A minimal example resembles:

// re2c $INPUT
*r re2c $INPUT -o $+OUTPUT
/*!re2c
!post_rule { /* post-rule 1 */ }
!post_rule { /* post-rule 2 */ }
*/

2. Build or obtain a vulnerable re2c binary: Ensure the target system is running re2c version ≤ 4.4.
3. Execute re2c with the crafted input: Run ./re2c <crafted_file.re> on the target system. The check_and_merge_special_rules function will fail to detect the missing rules for the non-conditioned block.
4. Trigger the crash: re2c proceeds to determinization with a null root TNFA state, causing a NULL pointer dereference in re2c::closure_leftmost_dfs at closure_leftmost.h:27, resulting in a segmentation fault and process termination (re2c Issue #571, PoC Repro).

• Process: Unexpected termination (SIGSEGV/segmentation fault) of the re2c process during build or code generation steps.
• Logs: AddressSanitizer output containing SEGV on unknown address 0x000000000018 and stack frames referencing re2c::closure_leftmost_dfs, re2c::closure_leftmost, re2c::tagged_epsilon_closure, and re2c::determinization.
• File System: Presence of unexpected or externally supplied .re input files in build directories, particularly those containing !post_rule or !pre_rule blocks without corresponding lexer rules (re2c Issue #571).

The maintainer has released a fix in commit febeb977936f9519a25d9fbd10ff8256358cdb97, which adds proper validation to emit an error and abort before determinization when a grammar block contains actions but no rules. Users should update re2c to a version that includes this patch (any release after 4.4 incorporating this commit, such as 4.5.1 or later as available on the GitHub releases page). No configuration-based workaround exists; the recommended action is to upgrade to a patched version (re2c Commit, re2c Releases).