CVE-2026-89162
LowCVSS 2.9Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.
Risk Assessment
Risk of leaking a small amount of data (two bytes) to an attacker, which may aid further exploitation in an already compromised environment.
Recommendation
Update PCRE2 to version 10.48 or later.
Other vulnerabilities in PCRE2
See all- CVE-2017-8786Critical
The pcre2test.c file in PCRE2 version 10.23 contains a vulnerability that allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression.
- CVE-2017-8399Critical
PCRE2 before 10.30 has an out-of-bounds write caused by a stack-based buffer overflow in pcre2_match.c, related to a 'pattern with very many captures.'
- CVE-2026-89161High
In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.
- CVE-2026-89160Low
PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.
- CVE-2026-89158Medium
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.
- CVE-2026-89157Medium
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.
- CVE-2026-89156Low
PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.
- CVE-2026-86145High
PCRE2 before 10.48 has an out-of-bounds write vulnerability in pcre2_dfa_match due to reuse of a cached workspace block without a size check during recursive DFA matching. This requires an attacker-controlled regular expression or a recursive pattern with a small heap limit.
Original NVD description (English source)
In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.