CVE-2026-89157: PCRE2 Buffer Overflow Vulnerability

CVE-2026-89157 Overview

CVE-2026-89157 is an out-of-bounds write vulnerability in PCRE2 (Perl Compatible Regular Expressions 2) versions before 10.48 on 32-bit platforms. The flaw resides in the pcre2_pattern_convert function and is triggered when an attacker supplies a sufficiently large regex pattern. The issue is classified under [CWE-190] (Integer Overflow or Wraparound), which enables the out-of-bounds write condition. Because PCRE2 is embedded in a wide range of applications, language runtimes, and network-facing services, exploitation can lead to memory corruption, application crashes, or code execution paths dependent on the calling process.

Critical Impact
Attacker-controlled regex patterns processed by 32-bit PCRE2 builds can trigger out-of-bounds writes, resulting in integrity and availability loss in affected applications.

Affected Products

PCRE2 versions prior to 10.48 on 32-bit platforms
PCRE2 10.48 release candidate 1 (pcre2:10.48:rc1)
Applications and language runtimes that link against vulnerable PCRE2 builds and call pcre2_pattern_convert

Discovery Timeline

2026-09-11 - CVE-2026-89157 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89157

Vulnerability Analysis

PCRE2 is a widely deployed regular expression library used by web servers, scripting languages, security tools, and embedded systems. The pcre2_pattern_convert function translates patterns between PCRE2's native syntax and alternative syntaxes such as glob or POSIX. On 32-bit platforms, size calculations performed against a large input pattern can wrap around the 32-bit integer boundary. The undersized allocation is then written past its bounds during conversion, corrupting adjacent heap memory.

This condition affects only 32-bit builds because the arithmetic overflow depends on the narrower size_t width. On 64-bit builds the same allocation math does not wrap, which is why the advisory scopes the issue to 32-bit platforms specifically. Consumers such as embedded devices, legacy servers, and mobile toolchains that still ship 32-bit PCRE2 are the primary exposure.

Root Cause

The root cause is an integer overflow in the allocation length calculation inside pcre2_pattern_convert. When the incoming pattern exceeds the size that the 32-bit arithmetic can represent, the computed buffer length wraps to a small value. PCRE2 then performs a conversion write loop that exceeds the actual allocation, producing an out-of-bounds heap write. See the GitHub Security Advisory GHSA-q8g2-wprr-34m9 for the maintainer's technical description.

Attack Vector

Exploitation requires the attacker to deliver a large regex pattern to an application that calls pcre2_pattern_convert on untrusted input. This can occur over the network in services that accept user-supplied regex, such as search endpoints, log processors, WAF rule ingestion, or API gateways. Attack complexity is high because the target must run a 32-bit PCRE2 build and expose the conversion API to attacker input. The technical details are documented in the PCRE2 10.48 release notes.

Detection Methods for CVE-2026-89157

Indicators of Compromise

Unexpected crashes or SIGSEGV signals in processes that call PCRE2 conversion routines on 32-bit hosts
Heap corruption diagnostics from allocators such as glibc's malloc reporting free(): invalid pointer or double free or corruption
Abnormally large regex patterns arriving in HTTP request bodies, query parameters, or configuration uploads

Detection Strategies

Inventory installed PCRE2 versions and architectures using package managers (dpkg -l | grep pcre2, rpm -qa | grep pcre2) and flag any 32-bit build below 10.48
Instrument applications with AddressSanitizer during pre-production testing to surface out-of-bounds writes in PCRE2 code paths
Deploy web application firewall rules that reject regex parameters exceeding a defined length threshold on services known to invoke pcre2_pattern_convert

Monitoring Recommendations

Collect and correlate application crash telemetry, core dumps, and allocator diagnostics from 32-bit hosts running services that parse user-supplied regex
Monitor request payload size distributions for regex-accepting endpoints and alert on statistical outliers
Track PCRE2 package versions through configuration management to confirm patch propagation across the fleet

How to Mitigate CVE-2026-89157

Immediate Actions Required

Upgrade PCRE2 to version 10.48 or later on all 32-bit systems and rebuild dependent applications that statically link the library
Identify network-facing services that expose pcre2_pattern_convert to untrusted input and place them behind input-size limits until patched
Prioritize remediation on 32-bit embedded devices, legacy servers, and mobile toolchains where PCRE2 is commonly bundled

Patch Information

The fix is included in PCRE2 10.48. Download the release from the PCRE2 Release Version 10.48 page and consult the vendor security advisory for the authoritative fix commit reference. Downstream Linux distributions will publish backported packages; apply vendor updates as they become available.

Workarounds

Enforce a maximum pattern length at the application layer before passing input to PCRE2 conversion functions
Where feasible, migrate the affected workload to a 64-bit build of PCRE2, which is not affected by the 32-bit integer overflow condition
Disable or restrict exposure of features that call pcre2_pattern_convert on attacker-controlled input until the upgrade is deployed

bash

# Configuration example: verify installed PCRE2 version and architecture
pcre2-config --version
file $(which pcre2test)
# Debian/Ubuntu: install patched package
sudo apt-get update && sudo apt-get install --only-upgrade libpcre2-8-0 libpcre2-16-0 libpcre2-32-0
# RHEL/Fedora: install patched package
sudo dnf upgrade pcre2