USN-8974-1: pcre2 vulnerabilities

Published Nov 3, 2026
·
Updated

It was discovered that PCRE2 did not correctly manage memory when processing certain patterns. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-86145)

Albert Zhang discovered that PCRE2 did not correctly process certain input. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-89156)

It was discovered that PCRE2 did not correctly handle large patterns. On 32-bit platforms, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-89157)

It was discovered that PCRE2 did not correctly handle certain patterns. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-89158)

Ilia Alshanetsky discovered that PCRE2 did not correctly handle certain input. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-89160)

It was discovered that PCRE2 did not correctly manage memory when handling certain patterns. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-89161)

It was discovered that PCRE2 could expose uninitialized data in certain circumstances. A local attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-89162)

Michael Allen discovered that PCRE2 did not correctly manage memory when using just-in-time compilation. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-103111)

Affected Software

91 affected componentsFixes available
ubuntu/pcre2<10.21-1ubuntu0.1~esm1
10.21-1ubuntu0.1~esm1
ubuntu/pcre2<10.31-2ubuntu0.1~esm2
10.31-2ubuntu0.1~esm2
ubuntu/pcre2<10.34-7ubuntu0.1+esm1
10.34-7ubuntu0.1+esm1
ubuntu/pcre2<10.39-3ubuntu0.2
10.39-3ubuntu0.2
ubuntu/pcre2<10.42-4ubuntu2.2
10.42-4ubuntu2.2
ubuntu/pcre2<10.46-1ubuntu1
10.46-1ubuntu1
ubuntu/pcre2<10.46-1ubuntu0.1
10.46-1ubuntu0.1
All of the following
ubuntu/libpcre2-16-0<10.46-1ubuntu1
10.46-1ubuntu1
Ubuntu Ubuntu=26.10
All of the following
ubuntu/libpcre2-32-0<10.46-1ubuntu1
10.46-1ubuntu1
Ubuntu Ubuntu=26.10
All of the following
ubuntu/libpcre2-8-0<10.46-1ubuntu1
10.46-1ubuntu1
Ubuntu Ubuntu=26.10
All of the following
ubuntu/libpcre2-dev<10.46-1ubuntu1
10.46-1ubuntu1
Ubuntu Ubuntu=26.10
All of the following
ubuntu/libpcre2-posix3<10.46-1ubuntu1
10.46-1ubuntu1
Ubuntu Ubuntu=26.10
All of the following
ubuntu/pcre2-utils<10.46-1ubuntu1
10.46-1ubuntu1
Ubuntu Ubuntu=26.10
All of the following
ubuntu/libpcre2-16-0<10.46-1ubuntu0.1
10.46-1ubuntu0.1
Ubuntu Ubuntu=26.04
All of the following
ubuntu/libpcre2-32-0<10.46-1ubuntu0.1
10.46-1ubuntu0.1
Ubuntu Ubuntu=26.04
All of the following
ubuntu/libpcre2-8-0<10.46-1ubuntu0.1
10.46-1ubuntu0.1
Ubuntu Ubuntu=26.04
All of the following
ubuntu/libpcre2-dev<10.46-1ubuntu0.1
10.46-1ubuntu0.1
Ubuntu Ubuntu=26.04
All of the following
ubuntu/libpcre2-posix3<10.46-1ubuntu0.1
10.46-1ubuntu0.1
Ubuntu Ubuntu=26.04
All of the following
ubuntu/pcre2-utils<10.46-1ubuntu0.1
10.46-1ubuntu0.1
Ubuntu Ubuntu=26.04
All of the following
ubuntu/libpcre2-16-0<10.42-4ubuntu2.2
10.42-4ubuntu2.2
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libpcre2-32-0<10.42-4ubuntu2.2
10.42-4ubuntu2.2
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libpcre2-8-0<10.42-4ubuntu2.2
10.42-4ubuntu2.2
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libpcre2-dev<10.42-4ubuntu2.2
10.42-4ubuntu2.2
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libpcre2-posix3<10.42-4ubuntu2.2
10.42-4ubuntu2.2
Ubuntu Ubuntu=24.04
All of the following
ubuntu/pcre2-utils<10.42-4ubuntu2.2
10.42-4ubuntu2.2
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libpcre2-16-0<10.39-3ubuntu0.2
10.39-3ubuntu0.2
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libpcre2-32-0<10.39-3ubuntu0.2
10.39-3ubuntu0.2
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libpcre2-8-0<10.39-3ubuntu0.2
10.39-3ubuntu0.2
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libpcre2-dev<10.39-3ubuntu0.2
10.39-3ubuntu0.2
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libpcre2-posix3<10.39-3ubuntu0.2
10.39-3ubuntu0.2
Ubuntu Ubuntu=22.04
All of the following
ubuntu/pcre2-utils<10.39-3ubuntu0.2
10.39-3ubuntu0.2
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libpcre2-16-0<Ubuntu Pro
Ubuntu Pro
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libpcre2-32-0<Ubuntu Pro
Ubuntu Pro
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libpcre2-8-0<Ubuntu Pro
Ubuntu Pro
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libpcre2-dev<Ubuntu Pro
Ubuntu Pro
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libpcre2-posix2<Ubuntu Pro
Ubuntu Pro
Ubuntu Ubuntu=20.04
All of the following
ubuntu/pcre2-utils<Ubuntu Pro
Ubuntu Pro
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libpcre2-16-0<Ubuntu Pro
Ubuntu Pro
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libpcre2-32-0<Ubuntu Pro
Ubuntu Pro
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libpcre2-8-0<Ubuntu Pro
Ubuntu Pro
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libpcre2-dev<Ubuntu Pro
Ubuntu Pro
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libpcre2-posix0<Ubuntu Pro
Ubuntu Pro
Ubuntu Ubuntu=18.04
All of the following
ubuntu/pcre2-utils<Ubuntu Pro
Ubuntu Pro
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libpcre2-16-0<10.21-1ubuntu0.1~esm1
10.21-1ubuntu0.1~esm1
Ubuntu Ubuntu=16.04
All of the following
ubuntu/libpcre2-32-0<10.21-1ubuntu0.1~esm1
10.21-1ubuntu0.1~esm1
Ubuntu Ubuntu=16.04
All of the following
ubuntu/libpcre2-8-0<10.21-1ubuntu0.1~esm1
10.21-1ubuntu0.1~esm1
Ubuntu Ubuntu=16.04
All of the following
ubuntu/libpcre2-dev<10.21-1ubuntu0.1~esm1
10.21-1ubuntu0.1~esm1
Ubuntu Ubuntu=16.04
All of the following
ubuntu/libpcre2-posix0<10.21-1ubuntu0.1~esm1
10.21-1ubuntu0.1~esm1
Ubuntu Ubuntu=16.04
All of the following
ubuntu/pcre2-utils<10.21-1ubuntu0.1~esm1
10.21-1ubuntu0.1~esm1
Ubuntu Ubuntu=16.04

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade ubuntu/pcre2 to a version that resolves this vulnerability.

    Fixed in 10.21-1ubuntu0.1~esm1
  2. Upgrade

    Upgrade ubuntu/pcre2 to a version that resolves this vulnerability.

    Fixed in 10.31-2ubuntu0.1~esm2
  3. Upgrade

    Upgrade ubuntu/pcre2 to a version that resolves this vulnerability.

    Fixed in 10.34-7ubuntu0.1+esm1
  4. Upgrade

    Upgrade ubuntu/pcre2 to a version that resolves this vulnerability.

    Fixed in 10.39-3ubuntu0.2
  5. Upgrade

    Upgrade ubuntu/pcre2 to a version that resolves this vulnerability.

    Fixed in 10.42-4ubuntu2.2
  6. Upgrade

    Upgrade ubuntu/pcre2 to a version that resolves this vulnerability.

    Fixed in 10.46-1ubuntu1
  7. Upgrade

    Upgrade ubuntu/pcre2 to a version that resolves this vulnerability.

    Fixed in 10.46-1ubuntu0.1
  8. Upgrade

    Upgrade ubuntu/libpcre2-16-0 to a version that resolves this vulnerability.

    Fixed in 10.46-1ubuntu1
  9. Upgrade

    Upgrade ubuntu/libpcre2-32-0 to a version that resolves this vulnerability.

    Fixed in 10.46-1ubuntu1
  10. Upgrade

    Upgrade ubuntu/libpcre2-8-0 to a version that resolves this vulnerability.

    Fixed in 10.46-1ubuntu1
  11. Upgrade

    Upgrade ubuntu/libpcre2-dev to a version that resolves this vulnerability.

    Fixed in 10.46-1ubuntu1
  12. Upgrade

    Upgrade ubuntu/libpcre2-posix3 to a version that resolves this vulnerability.

    Fixed in 10.46-1ubuntu1
  13. Upgrade

    Upgrade ubuntu/pcre2-utils to a version that resolves this vulnerability.

    Fixed in 10.46-1ubuntu1
  14. Upgrade

    Upgrade ubuntu/libpcre2-16-0 to a version that resolves this vulnerability.

    Fixed in 10.46-1ubuntu0.1
  15. Upgrade

    Upgrade ubuntu/libpcre2-32-0 to a version that resolves this vulnerability.

    Fixed in 10.46-1ubuntu0.1
  16. Upgrade

    Upgrade ubuntu/libpcre2-8-0 to a version that resolves this vulnerability.

    Fixed in 10.46-1ubuntu0.1
  17. Upgrade

    Upgrade ubuntu/libpcre2-dev to a version that resolves this vulnerability.

    Fixed in 10.46-1ubuntu0.1
  18. Upgrade

    Upgrade ubuntu/libpcre2-posix3 to a version that resolves this vulnerability.

    Fixed in 10.46-1ubuntu0.1
  19. Upgrade

    Upgrade ubuntu/pcre2-utils to a version that resolves this vulnerability.

    Fixed in 10.46-1ubuntu0.1
  20. Upgrade

    Upgrade ubuntu/libpcre2-16-0 to a version that resolves this vulnerability.

    Fixed in 10.42-4ubuntu2.2
  21. Upgrade

    Upgrade ubuntu/libpcre2-32-0 to a version that resolves this vulnerability.

    Fixed in 10.42-4ubuntu2.2
  22. Upgrade

    Upgrade ubuntu/libpcre2-8-0 to a version that resolves this vulnerability.

    Fixed in 10.42-4ubuntu2.2
  23. Upgrade

    Upgrade ubuntu/libpcre2-dev to a version that resolves this vulnerability.

    Fixed in 10.42-4ubuntu2.2
  24. Upgrade

    Upgrade ubuntu/libpcre2-posix3 to a version that resolves this vulnerability.

    Fixed in 10.42-4ubuntu2.2
  25. Upgrade

    Upgrade ubuntu/pcre2-utils to a version that resolves this vulnerability.

    Fixed in 10.42-4ubuntu2.2
  26. Upgrade

    Upgrade ubuntu/libpcre2-16-0 to a version that resolves this vulnerability.

    Fixed in 10.39-3ubuntu0.2
  27. Upgrade

    Upgrade ubuntu/libpcre2-32-0 to a version that resolves this vulnerability.

    Fixed in 10.39-3ubuntu0.2
  28. Upgrade

    Upgrade ubuntu/libpcre2-8-0 to a version that resolves this vulnerability.

    Fixed in 10.39-3ubuntu0.2
  29. Upgrade

    Upgrade ubuntu/libpcre2-dev to a version that resolves this vulnerability.

    Fixed in 10.39-3ubuntu0.2
  30. Upgrade

    Upgrade ubuntu/libpcre2-posix3 to a version that resolves this vulnerability.

    Fixed in 10.39-3ubuntu0.2
  31. Upgrade

    Upgrade ubuntu/pcre2-utils to a version that resolves this vulnerability.

    Fixed in 10.39-3ubuntu0.2
  32. Upgrade

    Upgrade ubuntu/libpcre2-16-0 to a version that resolves this vulnerability.

    Fixed in Ubuntu Pro
  33. Upgrade

    Upgrade ubuntu/libpcre2-32-0 to a version that resolves this vulnerability.

    Fixed in Ubuntu Pro
  34. Upgrade

    Upgrade ubuntu/libpcre2-8-0 to a version that resolves this vulnerability.

    Fixed in Ubuntu Pro
  35. Upgrade

    Upgrade ubuntu/libpcre2-dev to a version that resolves this vulnerability.

    Fixed in Ubuntu Pro
  36. Upgrade

    Upgrade ubuntu/libpcre2-posix2 to a version that resolves this vulnerability.

    Fixed in Ubuntu Pro
  37. Upgrade

    Upgrade ubuntu/pcre2-utils to a version that resolves this vulnerability.

    Fixed in Ubuntu Pro
  38. Upgrade

    Upgrade ubuntu/libpcre2-posix0 to a version that resolves this vulnerability.

    Fixed in Ubuntu Pro
  39. Upgrade

    Upgrade ubuntu/libpcre2-16-0 to a version that resolves this vulnerability.

    Fixed in 10.21-1ubuntu0.1~esm1
  40. Upgrade

    Upgrade ubuntu/libpcre2-32-0 to a version that resolves this vulnerability.

    Fixed in 10.21-1ubuntu0.1~esm1
  41. Upgrade

    Upgrade ubuntu/libpcre2-8-0 to a version that resolves this vulnerability.

    Fixed in 10.21-1ubuntu0.1~esm1
  42. Upgrade

    Upgrade ubuntu/libpcre2-dev to a version that resolves this vulnerability.

    Fixed in 10.21-1ubuntu0.1~esm1
  43. Upgrade

    Upgrade ubuntu/libpcre2-posix0 to a version that resolves this vulnerability.

    Fixed in 10.21-1ubuntu0.1~esm1
  44. Upgrade

    Upgrade ubuntu/pcre2-utils to a version that resolves this vulnerability.

    Fixed in 10.21-1ubuntu0.1~esm1

Event History

Nov 3, 2026
Advisory Published
via Ubuntu·12:00 AM
Data Sourced
via Ubuntu·12:00 AM
DescriptionAffected Software
Advisory Published
via OSV·03:46 PM
Data Sourced
via OSV·03:46 PM
DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

1

Which Ubuntu releases are explicitly listed as affected by the memory-management and input-processing issues?

CVE-2026-86145 and CVE-2026-89156 explicitly affect Ubuntu 20.04 LTS, 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10. Ubuntu 18.04 LTS is not listed for those two issues.

2

Does platform architecture change exposure to any of these issues?

Yes. CVE-2026-89157 is described as permitting possible arbitrary code execution specifically on 32-bit platforms when large patterns are handled; it explicitly affects Ubuntu 18.04 LTS through 26.10, including 26.10.

3

Which installed packages should be included when identifying systems that use the affected PCRE2 components?

Inventory the pcre2, pcre2-utils, libpcre2-8-0, libpcre2-16-0, libpcre2-32-0, libpcre2-posix3, and libpcre2-dev packages. Systems using these packages on the explicitly listed Ubuntu releases should be prioritized for remediation.

4

What security impact should triage account for?

The reported impacts include possible arbitrary code execution for CVE-2026-86145, CVE-2026-89157, and CVE-2026-89158, and possible denial of service for CVE-2026-89156. Exploitation is described in connection with processing attacker-controlled patterns or input, with large patterns specifically relevant to CVE-2026-89157.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203