CVE-2026-89158: PCRE2 Buffer Overflow Vulnerability

CVE-2026-89158 Overview

CVE-2026-89158 is an integer overflow vulnerability in PCRE2 (Perl Compatible Regular Expressions library) versions before 10.48 on 32-bit platforms. The flaw exists in the pcre2_compile_32 function and leads to a resultant out-of-bounds write when compiling crafted regular expression patterns. PCRE2 is widely embedded across programming language runtimes, web servers, and text-processing utilities, so downstream impact depends on how a host application accepts untrusted regex input. The issue is tracked under CWE-190: Integer Overflow or Wraparound and is addressed in the PCRE2 10.48 release.

Critical Impact
Attackers who can supply malicious regular expressions to a 32-bit PCRE2 build can trigger memory corruption, potentially compromising integrity and availability of the host process.

Affected Products

PCRE2 all versions prior to 10.48 on 32-bit platforms
PCRE2 10.48 release candidate 1 (pcre2-10.48-rc1)
Applications embedding vulnerable PCRE2 builds that expose regex compilation to untrusted input

Discovery Timeline

2026-09-11 - CVE-2026-89158 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89158

Vulnerability Analysis

The vulnerability resides in pcre2_compile_32, the 32-bit code-unit variant of PCRE2's pattern compiler. During compilation of a crafted pattern, an arithmetic calculation used to size an internal buffer overflows the 32-bit integer type. The wrapped result produces an allocation that is smaller than the data subsequently written into it. The compiler then performs an out-of-bounds write into adjacent heap memory. Exploitation requires the attacker to deliver a specially crafted regex to a process linked against a vulnerable 32-bit PCRE2 library. High attack complexity reflects the precision needed to craft a pattern that reliably triggers the overflow in the target build. Refer to the PCRE2 security advisory GHSA-fmgr-6ggq-9859 for authoritative technical detail.

Root Cause

The root cause is unchecked arithmetic on 32-bit integer types used to compute the compiled pattern's memory requirements. When the computed size wraps, PCRE2 allocates an undersized buffer and continues writing pattern-derived data past its bounds, corrupting adjacent heap structures.

Attack Vector

The attack vector is network-adjacent through any application layer that passes attacker-controlled regular expressions to PCRE2 for compilation. Common exposure points include web application firewall rules, log-parsing pipelines, database REGEXP operators, and scripting-language regex APIs on 32-bit builds. No authentication or user interaction is required if the wrapping application exposes regex compilation directly.

No verified public proof-of-concept has been published. See the PCRE2 10.48 release notes for the corrective patch and technical context.

Detection Methods for CVE-2026-89158

Indicators of Compromise

Unexpected crashes, segmentation faults, or heap corruption reports in processes that use PCRE2 on 32-bit systems
Application logs showing regex compilation failures immediately followed by process termination
Anomalous long or deeply nested regular expressions arriving from untrusted sources

Detection Strategies

Inventory all 32-bit binaries and packages linking against libpcre2-8, libpcre2-16, or libpcre2-32 and compare installed versions against 10.48
Enable heap hardening features such as MALLOC_CHECK_ or AddressSanitizer in test environments to surface out-of-bounds writes during regex compilation
Instrument web-facing services that accept user-supplied regular expressions to log pattern length, structure, and compile-time errors

Monitoring Recommendations

Monitor crash telemetry and core dumps from services that invoke pcre2_compile_32 on 32-bit hosts
Alert on repeated regex compilation failures from a single source, which may indicate probing for the overflow condition
Track package manager events for PCRE2 upgrades to confirm patch deployment across the fleet

How to Mitigate CVE-2026-89158

Immediate Actions Required

Upgrade PCRE2 to version 10.48 or later on all 32-bit systems and rebuild statically linked applications
Identify third-party software that bundles its own PCRE2 copy and apply vendor updates as they become available
Restrict or validate regular expressions received from untrusted sources at the application boundary

Patch Information

The fix is included in the PCRE2 10.48 release. Distribution details and source archives are available on the PCRE2 10.48 GitHub release page. Coordinated advisory information is published in GHSA-fmgr-6ggq-9859.

Workarounds

Where feasible, migrate affected workloads to 64-bit builds, which are not affected by this specific overflow
Enforce maximum length and complexity limits on user-supplied regex patterns before passing them to PCRE2
Isolate regex compilation in a sandboxed process so that memory corruption cannot escalate into the parent application

bash

# Verify installed PCRE2 version on Linux systems
pcre2-config --version

# Debian/Ubuntu: upgrade PCRE2 packages
sudo apt-get update && sudo apt-get install --only-upgrade libpcre2-8-0 libpcre2-16-0 libpcre2-32-0

# RHEL/Fedora: upgrade PCRE2 packages
sudo dnf upgrade pcre2 pcre2-utf16 pcre2-utf32