CVE-2026-89160: Low severity PCRE2 PCRE2 vulnerability
Published Sep 11, 2026
·Updated
PCRE2 before 10.48 has a pcre2match out-of-bounds read during the PCRE2MATCHINVALIDUTF matching of an invalid UTF subject.
Affected Software
1 affected component
PCRE2 PCRE2<10.48
Event History
Sep 11, 2026
CVE Published
via MITRE·04:09 AM
Data Sourced
via MITRE·04:09 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What conditions are required to trigger the issue?
An attacker must be able to supply an invalid UTF subject to PCRE2 matching performed with the PCRE2_MATCH_INVALID_UTF option. The CVSS vector indicates network reachability with no privileges or user interaction required, but exploitation has high attack complexity.
2
What is the impact if the vulnerability is triggered?
The issue causes an out-of-bounds read in pcre2_match. The reported impact is limited to availability; no confidentiality or integrity impact is specified.
3
Which versions need to be remediated?
PCRE2 versions before 10.48 are affected. Updating to PCRE2 10.48 or later addresses the affected version range.