UBUNTU-CVE-2026-103111: High severity ubuntu/pcre2 vulnerability
PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments are exposed when they use PCRE2 before 10.49, allow an attacker to control a regular expression, and use the affected JIT API pattern. The issue is not described as affecting every regular-expression use.
What does an attacker need to exploit this issue?
The attacker needs a way to supply a regular expression to the affected application. The CVSS vector indicates low privileges are required and no user interaction is required.
How can I determine whether my deployment is affected?
Check whether the deployed PCRE2 version is before 10.49, then determine whether the application processes attacker-controlled regular expressions through the relevant JIT API usage. Systems that do not meet both conditions are not identified by the available data as exposed.