CVE-2026-89156: PCRE2 Buffer Overflow Vulnerability

CVE-2026-89156 Overview

CVE-2026-89156 is an out-of-bounds read vulnerability in the Perl-Compatible Regular Expressions library version 2 (PCRE2) affecting all releases prior to 10.48. The flaw resides in the pcre2_match function and is triggered after a Just-In-Time (JIT) compiler fallback when an attacker supplies invalid UTF-encoded input data. Successful exploitation leads to a read past the bounds of an allocated buffer, which can crash the host process and cause denial of service. PCRE2 is embedded in a wide range of language runtimes, web servers, databases, and networking tools, so the vulnerability has a broad exposure surface. The issue is tracked as CWE-125 and was assigned a network attack vector.

Critical Impact
Remote attackers can cause an out-of-bounds read in any application that passes attacker-influenced UTF data through PCRE2 with JIT enabled, resulting in denial of service.

Affected Products

PCRE2 versions prior to 10.48
PCRE2 10.48-rc1 (release candidate)
Applications and language runtimes embedding vulnerable PCRE2 builds with JIT enabled

Discovery Timeline

2026-09-11 - CVE-2026-89156 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database
2026-09-21 - EPSS scoring data published

Technical Details for CVE-2026-89156

Vulnerability Analysis

The vulnerability is an out-of-bounds read inside pcre2_match, the primary matching entry point of the PCRE2 library. PCRE2 supports a Just-In-Time compilation path that generates native machine code for compiled patterns to accelerate matching. When the JIT path cannot handle certain conditions during execution, PCRE2 falls back to the interpreter to complete the match. This fallback path fails to correctly re-validate subject data assumptions after JIT execution has already advanced state. When the subject contains malformed UTF sequences, the interpreter reads memory outside the intended subject buffer.

Exploitation requires a network-reachable code path that accepts untrusted input and feeds it to PCRE2 as UTF-8, UTF-16, or UTF-32 subject data. The impact is limited to process availability, as the primary consequence is an application crash rather than data disclosure or code execution.

Root Cause

The root cause is inconsistent handling of invalid UTF sequences between the JIT-compiled matcher and the interpreter fallback in PCRE2. The JIT path assumes valid UTF input when the caller sets the corresponding UTF option without also setting PCRE2_MATCH_INVALID_UTF or a no-UTF-check option. When execution transitions from JIT to the interpreter mid-match, the interpreter continues from a state that violates its own UTF validity preconditions, leading to reads beyond the subject buffer.

Attack Vector

An attacker submits crafted input containing invalid UTF byte sequences to any service that evaluates the input against a PCRE2 regular expression with JIT enabled. This includes web application firewalls, HTTP servers, log processors, and scripting language runtimes that expose regex matching to user-supplied strings. No authentication or user interaction is required. See the GitHub Security Advisory GHSA-2p8c-ff85-vh9x for the vendor's technical description.

No public proof-of-concept exploit is available at the time of publication.

Detection Methods for CVE-2026-89156

Indicators of Compromise

Unexpected crashes or SIGSEGV signals in processes that link libpcre2-8, libpcre2-16, or libpcre2-32
Application logs showing regex-matching errors immediately followed by process termination or restart
Repeated malformed UTF-8 payloads targeting regex-processing endpoints such as search, filtering, or WAF rule engines

Detection Strategies

Inventory installed PCRE2 versions using package managers (dpkg -l libpcre2*, rpm -qa | grep pcre2) and flag any version below 10.48
Enumerate loaded PCRE2 libraries in running processes with lsof or /proc/*/maps to catch statically or bundled deployments
Deploy WAF or IDS signatures that identify anomalous rates of malformed UTF-8 in request bodies and query parameters

Monitoring Recommendations

Alert on abnormal crash rates in services that perform regex evaluation on external input
Monitor core dumps and crash telemetry for stack frames referencing pcre2_match or sljit-generated code
Track PCRE2 package versions across the fleet and generate alerts when unpatched versions are detected

How to Mitigate CVE-2026-89156

Immediate Actions Required

Upgrade PCRE2 to version 10.48 or later across all endpoints, servers, and container images
Rebuild and redistribute any applications that statically link PCRE2 after updating the library
Restart services that dynamically load PCRE2 so they pick up the patched shared library
Prioritize remediation on internet-facing services that accept arbitrary text input

Patch Information

The PCRE2 project fixed this vulnerability in the PCRE2 Release v10.48. Downstream Linux distributions and language runtimes that vendor PCRE2 should ship updated packages referencing this release. Consult the GitHub Security Advisory GHSA-2p8c-ff85-vh9x for backport guidance.

Workarounds

Disable JIT compilation in PCRE2 by not calling pcre2_jit_compile or by building the library with JIT support disabled
Validate and normalize UTF-8 input before passing it to pcre2_match and reject sequences that fail strict validation
Set the PCRE2_MATCH_INVALID_UTF option when compiling patterns so the matcher tolerates malformed UTF safely
Constrain input length and character sets at the application boundary to reduce exposure while patching is scheduled

bash

# Verify installed PCRE2 version on Debian/Ubuntu
dpkg -l | grep -i pcre2

# Verify installed PCRE2 version on RHEL/Fedora
rpm -qa | grep -i pcre2

# Query pkg-config for the linked PCRE2 version
pkg-config --modversion libpcre2-8