CVE-2026-86145
HighCVSS 8.2Summary
PCRE2 before 10.48 has an out-of-bounds write vulnerability in pcre2_dfa_match due to reuse of a cached workspace block without a size check during recursive DFA matching. This requires an attacker-controlled regular expression or a recursive pattern with a small heap limit.
Risk Assessment
The vulnerability can lead to application crashes or potentially arbitrary code execution in the context of the process using PCRE2. Attackers could exploit this to corrupt memory, potentially gaining control of the application.
Recommendation
Update PCRE2 to version 10.48 or later, which includes the fix. Also avoid processing untrusted regular expressions in environments with restricted heap limits.
Other vulnerabilities in PCRE2
See all- CVE-2017-8786Critical
The pcre2test.c file in PCRE2 version 10.23 contains a vulnerability that allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression.
- CVE-2017-8399Critical
PCRE2 before 10.30 has an out-of-bounds write caused by a stack-based buffer overflow in pcre2_match.c, related to a 'pattern with very many captures.'
Original NVD description (English source)
PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).