CVE-2026-89161: High severity PCRE2 PCRE2 vulnerability

Q: What must occur for exploitation to be possible?

An attacker would need to cause pcre2_jit_match to receive a previously copied subject as a context. The issue is an incorrect free operation in that condition.

Q: Are remotely accessible default deployments indicated as affected?

The supplied vector indicates local access, high attack complexity, no privileges required, and no user interaction. It does not provide information about default configurations or remote exposure.

Q: What versions should be considered vulnerable?

PCRE2 versions before 10.48 are affected. Updating to PCRE2 10.48 or later addresses the affected version range.

Published Sep 11, 2026

Updated

In PCRE2 before 10.48, pcre2jitmatch mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.

Affected Software

1 affected component

PCRE2 PCRE2<10.48

Event History

Sep 11, 2026

CVE Published

via MITRE·04:11 AM

Data Sourced

via MITRE·04:11 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What must occur for exploitation to be possible?

An attacker would need to cause pcre2_jit_match to receive a previously copied subject as a context. The issue is an incorrect free operation in that condition.

Are remotely accessible default deployments indicated as affected?

The supplied vector indicates local access, high attack complexity, no privileges required, and no user interaction. It does not provide information about default configurations or remote exposure.

What versions should be considered vulnerable?