CVE-2026-89160: PCRE2 Buffer Overflow Vulnerability

CVE-2026-89160 Overview

CVE-2026-89160 is an out-of-bounds read vulnerability in Perl-Compatible Regular Expressions 2 (PCRE2) before version 10.48. The flaw occurs in the pcre2_match function when matching invalid UTF subjects with the PCRE2_MATCH_INVALID_UTF option enabled. An attacker who controls regex input or the subject buffer can trigger memory reads beyond allocated bounds. The vulnerability is classified under [CWE-125] (Out-of-Bounds Read).

Critical Impact
Applications using PCRE2 with PCRE2_MATCH_INVALID_UTF on attacker-influenced data may leak process memory or crash, affecting confidentiality and availability of services embedding the library.

Affected Products

PCRE2 versions prior to 10.48
PCRE2 10.48-rc1 release candidate
Applications and language runtimes bundling vulnerable PCRE2 builds

Discovery Timeline

2026-09-11 - CVE-2026-89160 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89160

Vulnerability Analysis

The defect resides in the PCRE2 matching engine invoked through pcre2_match. When callers set the PCRE2_MATCH_INVALID_UTF flag, the engine is expected to tolerate malformed UTF sequences in the subject string. Under specific inputs, the engine reads past the end of the subject buffer instead of stopping at the declared length.

This behavior can disclose adjacent heap memory to the caller through match state, or cause a segmentation fault when the read crosses an unmapped page boundary. The impact scope is limited to the process embedding PCRE2, but that process is often a web server, scripting runtime, or network daemon exposed to untrusted input.

Root Cause

The root cause is missing or incorrect bounds validation during invalid-UTF matching paths. The engine advances a subject pointer without re-checking the buffer end when handling truncated or malformed UTF sequences. See the GitHub Security Advisory GHSA-9qww-pwc4-77qq for maintainer analysis.

Attack Vector

Exploitation requires the target application to invoke pcre2_match with PCRE2_MATCH_INVALID_UTF on attacker-supplied data. Because PCRE2 is embedded in numerous language ecosystems and network services, the attack surface reaches network-exposed endpoints. Successful exploitation causes information disclosure of adjacent memory contents or process termination resulting in denial of service.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.212%.

Detection Methods for CVE-2026-89160

Indicators of Compromise

Unexpected crashes or SIGSEGV signals in processes linking against PCRE2 shared libraries
Application error logs referencing pcre2_match failures or malformed UTF-8 input
Anomalous outbound responses containing byte patterns not sourced from application data

Detection Strategies

Inventory installed PCRE2 versions using package managers (dpkg -l libpcre2-8-0, rpm -q pcre2) and flag versions below 10.48
Perform software composition analysis (SCA) on application dependencies to identify statically linked PCRE2 in language runtimes and binaries
Review source code for calls to pcre2_match that pass the PCRE2_MATCH_INVALID_UTF option flag

Monitoring Recommendations

Enable core dump collection and centralized crash reporting on services parsing user-supplied regex or text
Monitor endpoint telemetry for repeated process restarts of web servers, application runtimes, or search services
Alert on abnormal error rates from HTTP handlers that perform regex matching on request bodies or headers

How to Mitigate CVE-2026-89160

Immediate Actions Required

Upgrade PCRE2 to version 10.48 or later across all systems and container images
Rebuild or repackage applications that statically link PCRE2 against the patched release
Identify downstream language bindings (PHP, Rust pcre2, Ruby, Python regex) and update to versions bundling fixed PCRE2

Patch Information

The fix is included in the PCRE2 Release v10.48. Detailed advisory information is available in the GitHub Security Advisory GHSA-9qww-pwc4-77qq. Distribution maintainers typically backport the fix to supported LTS releases; consult your vendor's security tracker.

Workarounds

Avoid passing the PCRE2_MATCH_INVALID_UTF option flag where feasible and pre-validate UTF-8 input before matching
Constrain the size and character set of user-supplied regex subjects at the application boundary
Isolate services that must process untrusted regex input using process sandboxing or containers with tight resource limits

bash

# Verify installed PCRE2 version on Debian/Ubuntu systems
dpkg -l | grep -i pcre2
apt-get update && apt-get install --only-upgrade libpcre2-8-0 libpcre2-16-0 libpcre2-32-0

# Verify installed PCRE2 version on RHEL/Fedora systems
rpm -q pcre2
dnf upgrade pcre2

# Confirm the runtime library version
pcre2-config --version