UBUNTU-CVE-2026-89160: Medium severity ubuntu/pcre2 vulnerability
Published Sep 11, 2026
·Updated
PCRE2 before 10.48 has a pcre2match out-of-bounds read during the PCRE2MATCHINVALIDUTF matching of an invalid UTF subject.
Affected Software
5 affected components
ubuntu/pcre2*
ubuntu/pcre2*
ubuntu/pcre2*
ubuntu/pcre2*
ubuntu/pcre2*
Event History
Sep 11, 2026
CVE Published
via OSV·04:18 AM
Data Sourced
via OSV·04:18 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What conditions are required to trigger the issue?
An attacker must be able to supply an invalid UTF subject to PCRE2 matching performed with the PCRE2_MATCH_INVALID_UTF option. Exploitation is network-reachable and requires no privileges or user interaction, but the attack complexity is rated high.
2
What is the practical impact?
The issue is an out-of-bounds read in pcre2_match. The reported impact is limited to availability, with low availability impact and no reported confidentiality or integrity impact.
3
Which PCRE2 versions are affected?
PCRE2 versions before 10.48 are affected.