CVE-2026-89161: High severity PCRE2 PCRE2 vulnerability
Published Sep 11, 2026
·Updated
In PCRE2 before 10.48, pcre2jitmatch mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.
Affected Software
3 affected components
PCRE2 PCRE2<10.48
PCRE pcre2<10.48
PCRE pcre2=10.48-rc1
Remediation
Patch Available
Event History
Sep 11, 2026
CVE Published
via MITRE·04:11 AM
Data Sourced
via MITRE·04:11 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:18 AM
RemedyDescriptionSeverityWeaknessAffected Software
Sep 12, 2026
Data Sourced
via Microsoft·08:03 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What must occur for exploitation to be possible?
An attacker would need to cause pcre2_jit_match to receive a previously copied subject as a context. The issue is an incorrect free operation in that condition.
2
Are remotely accessible default deployments indicated as affected?
The supplied vector indicates local access, high attack complexity, no privileges required, and no user interaction. It does not provide information about default configurations or remote exposure.
3
What versions should be considered vulnerable?
PCRE2 versions before 10.48 are affected. Updating to PCRE2 10.48 or later addresses the affected version range.