In PCRE2 versions prior to 10.48, the function pcre2_jit_match improperly handles memory management for a previously copied subject passed as a context parameter. This mishandling results in an incorrect free operation on memory not allocated on the heap, classified as CWE-590 (Free of Memory not on the Heap). The vulnerability can lead to memory corruption, potentially causing denial of service or arbitrary code execution. The CVSS 3.1 base score is 7.4, indicating high severity with attack vector local, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can cause memory corruption due to freeing memory not allocated on the heap. This can lead to application crashes (denial of service) or potentially allow an attacker to execute arbitrary code with the privileges of the affected application. The attack requires local access and has high complexity, limiting ease of exploitation.

A fix is available in PCRE2 version 10.48 and later. Users should upgrade to version 10.48 or newer to remediate this vulnerability. No vendor advisory content was provided, but the affected versions are explicitly stated and the patch version is known.