UBUNTU-CVE-2026-86145: High severity ubuntu/pcre2 vulnerability
PCRE2 before 10.48 allows a pcre2dfamatch out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
Exploitation requires either an attacker-controlled regular expression, or a recursive pattern used with a small heap limit. The heap limit can be set through the PCRE2 API.
Which PCRE2 matching interface is involved?
The out-of-bounds write occurs in pcre2_dfa_match, specifically when a cached workspace block is reused during recursive DFA matching.
Are applications using fixed, trusted regular expressions exposed?
The described attack condition requires attacker-controlled regular expressions, unless a recursive pattern is used together with a small API-configured heap limit. Applications that do not meet either condition are not described as triggering the issue.