UBUNTU-CVE-2026-89161: High severity ubuntu/pcre2 vulnerability
In PCRE2 before 10.48, pcre2jitmatch mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using PCRE2 versions before 10.48 may be affected. The attack vector is local, so an attacker needs the ability to execute code or otherwise invoke the vulnerable PCRE2 functionality on the system.
What conditions are required to trigger the vulnerability?
The issue involves pcre2_jit_match when a previously copied subject is passed as a context. Exploitation requires reaching that specific usage pattern and may be difficult, as reflected by the high attack complexity rating.
What should I do if my installed PCRE2 version is affected?
Update PCRE2 to version 10.48 or later. If an update cannot be applied immediately, identify and limit local access to applications that invoke pcre2_jit_match with copied subjects used as contexts.
How can I check whether an application may be vulnerable?
Confirm the PCRE2 version in use and review whether it is earlier than 10.48. Applications are relevant if they call pcre2_jit_match and can pass a previously copied subject as a context.