CVE-2026-103111: PCRE2 Buffer Overflow Vulnerability

CVE-2026-103111 Overview

CVE-2026-103111 is an out-of-bounds write vulnerability in the Perl Compatible Regular Expressions library version 2 (PCRE2) affecting all releases before 10.49. The flaw occurs when an attacker-controlled regular expression is processed through certain Just-In-Time (JIT) compilation API usage patterns. Successful exploitation writes arbitrary data outside allocated memory boundaries, corrupting adjacent structures. PCRE2 is embedded in thousands of applications, language runtimes, and network services, giving this defect broad reach across the software supply chain. The vulnerability is tracked under [CWE-787: Out-of-bounds Write].

Critical Impact
Attackers who can supply regex patterns to a vulnerable PCRE2 consumer using the JIT API can corrupt process memory, enabling data tampering, service disruption, and potential code execution paths.

Affected Products

PCRE2 library versions prior to 10.49
Applications, language interpreters, and services that expose PCRE2 JIT compilation to user-supplied patterns
Downstream distributions and container images bundling vulnerable PCRE2 builds

Discovery Timeline

2026-09-30 - CVE-2026-103111 published to the National Vulnerability Database
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-103111

Vulnerability Analysis

The defect resides in the PCRE2 JIT compiler, which translates compiled regex bytecode into native machine code for higher throughput. When the calling application follows specific JIT API usage patterns and passes an attacker-controlled pattern, the compiler writes past the bounds of a target buffer with arbitrary data derived from the pattern. Because JIT output and supporting metadata sit in memory the process itself trusts, the corruption directly influences execution state. Consumers most at risk are services that accept regex from remote users, such as log processors, data validation engines, WAF rule loaders, and scripting hosts.

Root Cause

The root cause is missing or insufficient bounds enforcement during JIT code generation for adversarial patterns. Specific constructs cause the compiler to miscalculate a size or offset, then emit writes that exceed the allocated region. See the PCRE2 GitHub Security Advisory for the technical breakdown and the exact code paths modified in the fix.

Attack Vector

Exploitation requires the target application to compile an attacker-supplied pattern with pcre2_jit_compile (or equivalent bindings). The attacker submits a crafted regex through any input channel that reaches PCRE2, then triggers compilation. No user interaction is required beyond submitting the pattern. The impact ranges from process crash to memory corruption suitable for follow-on exploitation. Authentication requirements depend on how the host application exposes regex input.

No verified proof-of-concept code is available. Refer to the GitHub Security Advisory linked above for reproduction details once released by the maintainers.

Detection Methods for CVE-2026-103111

Indicators of Compromise

Unexpected crashes or segmentation faults in processes that link libpcre2-8, libpcre2-16, or libpcre2-32
Anomalous memory allocation patterns or heap corruption traces in services that accept user-supplied regex
Application logs showing regex compilation failures immediately preceding process termination

Detection Strategies

Inventory all binaries and container images linking PCRE2 and correlate versions against the 10.49 threshold using software composition analysis
Instrument high-risk services with AddressSanitizer or equivalent tooling in staging to surface out-of-bounds writes during fuzzing
Alert on child process termination signals SIGSEGV and SIGABRT from applications that expose regex input externally

Monitoring Recommendations

Forward crash telemetry, core dumps, and structured application logs to a centralized analytics pipeline for correlation
Track regex submission endpoints for unusual pattern length, nesting depth, or repeated compilation failures
Monitor package repositories and base images for PCRE2 updates and enforce rebuilds when downstream fixes ship

How to Mitigate CVE-2026-103111

Immediate Actions Required

Upgrade PCRE2 to version 10.49 or later across all operating systems, language runtimes, and container images
Rebuild and redeploy applications statically linked against vulnerable PCRE2 versions
Audit exposed services to identify any endpoint that compiles user-supplied regular expressions with the JIT API

Patch Information

The PCRE2 maintainers addressed the issue in release 10.49. Consult the PCRE2 GitHub Security Advisory GHSA-r9hj-j2rw-4q3m for the authoritative patch reference and downstream distribution updates.

Workarounds

Disable JIT compilation in affected applications by omitting pcre2_jit_compile calls or configuring interpreters to run PCRE2 in interpreted mode
Reject or sanitize externally supplied regular expressions, enforcing strict allowlists and complexity limits before compilation
Isolate regex processing in sandboxed workers with reduced privileges to contain the impact of memory corruption

bash

# Verify installed PCRE2 version on Linux hosts
pcre2-config --version

# Debian/Ubuntu upgrade example
sudo apt-get update && sudo apt-get install --only-upgrade libpcre2-8-0 libpcre2-16-0 libpcre2-32-0

# Confirm no processes still map an older libpcre2
lsof 2>/dev/null | grep -i libpcre2