CVE-2026-89162 PCRE CVE debrief

Who should care

Defenders and developers using PCRE2 in their systems should assess exposure and prioritize remediation based on the CVSS score of 2.9. This includes verifying if their systems use vulnerable PCRE2 versions, reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and planning vendor-supported updates or mitigations through normal change control where exposure

Why it matters

CVE-2026-89162 is a low-severity vulnerability in PCRE2 that might disclose two bytes to an adversary in unsafe situations. Defenders should assess exposure, particularly in contexts where PCRE2 is used and access is limited. The potential impact is low, but verification of affected versions and remediation priority are necessary.

• Potential information disclosure in PCRE2
• Verification of affected versions required
• Remediation priority based on CVSS score

Technical summary

The pcre2_serialize_encode function in PCRE2 before version 10.48 might disclose two bytes to an adversary in situations where access is already unsafe. This vulnerability exists in PCRE2 versions prior to 10.48 and could potentially lead to information disclosure in already compromised environments. The CVSS score of 2.9 indicates a low severity, but defenders should still verify if their systems use vulnerable PCRE2 versions and prioritize remediation accordingly.

Defensive priority

Defenders should verify if their systems use vulnerable PCRE2 versions and prioritize remediation based on the CVSS score of 2.9.

Recommended defensive actions

• Verify if systems use vulnerable PCRE2 versions
• Prioritize remediation based on CVSS score
• Monitor for potential information disclosure

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is needed to determine the full scope of affected systems and remediation steps.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.