CVE-2026-89157: Integer Overflow
Published Sep 11, 2026
·Updated
PCRE2 before 10.48, on 32-bit platforms, has a pcre2patternconvert out-of-bounds write when an attacker can provide a large pattern.
Affected Software
1 affected component
PCRE2 Project PCRE2<10.48
Event History
Sep 11, 2026
CVE Published
via MITRE·04:05 AM
Data Sourced
via MITRE·04:05 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which systems are affected?
The issue affects PCRE2 versions before 10.48 running on 32-bit platforms. The described vulnerable code path is pcre2_pattern_convert.
2
What must an attacker provide to trigger the issue?
An attacker must be able to supply a large pattern to pcre2_pattern_convert. The vulnerability is an out-of-bounds write caused by an integer overflow.
3
Does exploitation require authentication or user interaction?
The supplied severity vector indicates no privileges are required and no user interaction is required. Exploitation is local and has high attack complexity.
4
What is the remediation?
Upgrade PCRE2 to version 10.48 or later. The issue is reported in versions before 10.48.