PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-89161 PCRE CVE debrief

A high-severity vulnerability exists in PCRE2 before version 10.48, where the `pcre2_jit_match` function mishandles a previously copied subject being passed in as a context, leading to an incorrect free operation. This issue affects systems and applications using PCRE2, potentially leading to denial of service or code execution if exploited. Defenders responsible for these systems should assess exposure and prioritize verification and mitigation. The vulnerability has a high CVSS score of 7.4, emphasizing the need for prompt attention and remediation.

Vendor
PCRE
Product
PCRE2
CVSS
HIGH 7.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-11
Original CVE updated
2026-09-11
Advisory published
2026-09-11
Advisory updated
2026-09-11

Who should care

Defenders responsible for systems and applications using PCRE2 should assess exposure and prioritize verification and mitigation of this vulnerability.

Why it matters

This high-severity vulnerability in PCRE2 requires attention from defenders responsible for systems and applications using the library, as it could lead to denial of service or code execution if exploited.

  • Potential denial of service due to incorrect memory management
  • Possible code execution or privilege escalation if exploited
  • Requires verification of PCRE2 version and upgrade to 10.48 or later
  • Defenders should monitor for potential exploitation attempts

Technical summary

The `pcre2_jit_match` function in PCRE2 before version 10.48 mishandles a previously copied subject being passed in as a context, leading to an incorrect free operation. This vulnerability has a high CVSS score of 7.4, indicating a significant risk. Affected systems and applications should be reviewed and upgraded to PCRE2 version 10.48 or later to mitigate this vulnerability. Defenders should prioritize verification and remediation efforts.

Defensive priority

Defenders should prioritize verifying and upgrading to PCRE2 version 10.48 or later to mitigate this vulnerability.

Recommended defensive actions

  • Verify PCRE2 version and upgrade to 10.48 or later if necessary
  • Review and update affected systems and applications
  • Monitor for potential exploitation attempts

Evidence notes

The vulnerability is described in the CVE record and NVD vulnerability detail page. The PCRE2 project has released a fix in version 10.48. Evidence is limited to public CVE and NVD sources. Defenders should verify PCRE2 version and review affected systems and applications. No additional details are available from the CVE Program or NVD.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-89161 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-89161

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-89161 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-89161

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.