CVE-2026-89156 PCRE CVE debrief

Who should care

Defenders responsible for systems that utilize PCRE2, especially those processing user-input data, should assess the exposure of these systems and prioritize verifying the version of PCRE2 in use.

Why it matters

A low-severity vulnerability in PCRE2 before version 10.48 could lead to an out-of-bounds read after a JIT fallback when an attacker provides invalid UTF data. Defenders should prioritize verifying the version of PCRE2 in use and assessing the exposure of systems that utilize this library.

• Verify PCRE2 version and assess exposure
• Review and update systems that utilize PCRE2
• Consider upgrading to PCRE2 version 10.48 or later

Technical summary

The vulnerability exists in the pcre2_match function of PCRE2 before version 10.48. An out-of-bounds read can occur after a JIT fallback when an attacker provides invalid UTF data. The CVSS score for this vulnerability is 2.9, indicating a low severity.

Defensive priority

Defenders should prioritize verifying the version of PCRE2 in use and assessing the exposure of systems that utilize this library, especially those that process user-input data.

Recommended defensive actions

• Verify the version of PCRE2 in use and assess exposure
• Review systems that utilize PCRE2, especially those processing user-input data
• Consider upgrading to PCRE2 version 10.48 or later

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with a CVSS score of 2.9 and a description of the issue. However, the exact versions affected, exploitation details, and remediation steps require verification from the official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.