CVE-2008-1026: Apple Safari

Medium severity, CVSS 6.8. EPSS: 4.8% chance of exploitation in the next 30 days.

Integer overflow in the PCRE regular expression compiler (JavaScriptCore/pcre/pcre_compile.cpp) in Apple WebKit, as used in Safari before 3.1.1, allows remote attackers to execute arbitrary code via a regular expression with large, nested repetition counts, which triggers a heap-based buffer overflow.

Affected products

• Apple Safari: version 3 only; version 3.1 only

Published 2008-04-17. Last modified 2026-06-16.