UBUNTU-CVE-2026-89156: Medium severity ubuntu/pcre2 vulnerability
Published Sep 11, 2026
·Updated
PCRE2 before 10.48 has a pcre2match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.
Affected Software
5 affected components
ubuntu/pcre2*
ubuntu/pcre2*
ubuntu/pcre2*
ubuntu/pcre2*
ubuntu/pcre2*
Event History
Sep 11, 2026
CVE Published
via OSV·04:18 AM
Data Sourced
via OSV·04:18 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What conditions are required for exploitation?
An attacker must be able to supply invalid UTF data to a PCRE2 matching operation. The out-of-bounds read occurs after a JIT fallback, and the vulnerability has a local attack vector with high attack complexity.
2
What is the impact?
The reported impact is availability loss only; confidentiality and integrity are listed as unaffected. Successful exploitation may cause a low-severity availability impact.
3
Which versions are affected?
PCRE2 versions before 10.48 are affected. The provided data identifies the Ubuntu package as ubuntu/pcre2 but does not specify fixed Ubuntu package versions.