PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-89162 PCRE CVE debrief

A low-severity vulnerability exists in PCRE2 before version 10.48, where the pcre2_serialize_encode function might disclose two bytes to an adversary in an already unsafe situation. This vulnerability affects systems using PCRE2, requiring defenders and system administrators to assess exposure and prioritize verification of PCRE2 versions in use. The vulnerability is classified as low-severity, with a CVSS score of 2.9. The CVE record and NVD entry provide limited information about the vulnerability.

Vendor
PCRE
Product
PCRE2
CVSS
LOW 2.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-11
Original CVE updated
2026-09-14
Advisory published
2026-09-11
Advisory updated
2026-09-14

Who should care

Defenders and system administrators responsible for systems using PCRE2 should assess exposure and prioritize verification of PCRE2 versions in use.

Why it matters

CVE-2026-89162 is a low-severity vulnerability in PCRE2 that might disclose two bytes to an adversary in already unsafe situations, requiring defenders to assess exposure and prioritize verification of PCRE2 versions in use.

  • Verification of PCRE2 versions in use is necessary to determine exposure
  • Disclosed bytes could potentially be used to gather additional information about the system
  • Upgrade to PCRE2 version 10.48 or later may be necessary to mitigate the vulnerability

Technical summary

The pcre2_serialize_encode function in PCRE2 before version 10.48 might disclose two bytes to an adversary in situations where the access available to the adversary is already unsafe. This vulnerability is a low-severity issue, with a CVSS score of 2.9. Defenders should assess exposure and prioritize verification of PCRE2 versions in use, especially in systems where the adversary already has unsafe access.

Defensive priority

Defenders should assess exposure and prioritize verification of PCRE2 versions in use, especially in systems where the adversary already has unsafe access.

Recommended defensive actions

  • Assess PCRE2 versions in use and prioritize verification
  • Review system configurations for unsafe access
  • Consider upgrading to PCRE2 version 10.48 or later

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The NVD entry is currently Undergoing Analysis. Defenders should verify PCRE2 versions in use, review system configurations for unsafe access, and consider upgrading to PCRE2 version 10.48 or later. The vulnerability might disclose two bytes to an adversary in situations where the access available to the adversary is already unsafe.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-89162 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-89162

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-89162 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-89162

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.