CVE-2026-89156: Low severity PCRE2 PCRE2 vulnerability
PCRE2 before 10.48 has a pcre2match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
An attacker must be able to supply invalid UTF data to pcre2_match. The out-of-bounds read occurs after a JIT fallback, and the CVSS vector indicates local access and high attack complexity.
Which installations should be prioritized for remediation?
Prioritize systems using PCRE2 versions earlier than 10.48 where untrusted or attacker-controlled input can reach pcre2_match and may contain invalid UTF data. The provided information does not establish whether a default configuration is affected.
What can be done if upgrading is not immediately possible?
Prevent untrusted invalid UTF data from reaching pcre2_match, particularly in processing paths that can use JIT and fall back from it. The provided information does not identify a vendor-supported workaround beyond updating to PCRE2 10.48 or later.