CVE-2026-89160: Medium severity PCRE2 PCRE2 vulnerability
PCRE2 before 10.48 has a pcre2match out-of-bounds read during the PCRE2MATCHINVALIDUTF matching of an invalid UTF subject.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.48-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.95-6
Event History
Frequently Asked Questions
What conditions are required to trigger the issue?
An attacker must be able to supply an invalid UTF subject to PCRE2 matching performed with the PCRE2_MATCH_INVALID_UTF option. The CVSS vector indicates network reachability with no privileges or user interaction required, but exploitation has high attack complexity.
What is the impact if the vulnerability is triggered?
The issue causes an out-of-bounds read in pcre2_match. The reported impact is limited to availability; no confidentiality or integrity impact is specified.
Which versions need to be remediated?
PCRE2 versions before 10.48 are affected. Updating to PCRE2 10.48 or later addresses the affected version range.