CVE-2026-86145
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
PCRE2 before 10.48 has an out-of-bounds write vulnerability in pcre2_dfa_match due to reuse of a cached workspace block without a size check during recursive DFA matching. This requires an attacker-controlled regular expression or a recursive pattern with a small heap limit.
Risk Assessment
The vulnerability can lead to application crashes or potentially arbitrary code execution in the context of the process using PCRE2. Attackers could exploit this to corrupt memory, potentially gaining control of the application.
Recommendation
Update PCRE2 to version 10.48 or later, which includes the fix. Also avoid processing untrusted regular expressions in environments with restricted heap limits.
Other vulnerabilities in PCRE2
See all- CVE-2017-8786Critical
The pcre2test.c file in PCRE2 version 10.23 contains a vulnerability that allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression.
- CVE-2017-8399Critical
PCRE2 before 10.30 has an out-of-bounds write caused by a stack-based buffer overflow in pcre2_match.c, related to a 'pattern with very many captures.'
- CVE-2026-103111High
PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.
- CVE-2026-89162Low
In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.
- CVE-2026-89161High
In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.
- CVE-2026-89160Low
PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.
- CVE-2026-89158Medium
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.
- CVE-2026-89157Medium
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.
- CVE-2026-89156Low
PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.
Original NVD description (English source)
PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS