Perl-Compatible Regular Expression (PCRE) library before 7.0 does not properly calculate sizes for unspecified \multiple forms of character class\ which triggers a buffer overflow that allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code.