An integer overflow in the searchinrange function in regexec.c in Oniguruma 6.x before 6.9.4rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression.

An issue was discovered in Oniguruma 6.x before 6.9.4rc2. In the function fetchintervalquantifier (formerly known as fetchrangequantifier) in regparse.c, PFETCH is called without checking PEND. This leads to a heap-based buffer over-read.