CVE-2026-89161: PCRE2 Use-After-Free Vulnerability

CVE-2026-89161 Overview

CVE-2026-89161 is a memory safety flaw in PCRE2 (Perl Compatible Regular Expressions library, version 2) affecting all releases before 10.48. The pcre2_jit_match function mishandles a previously copied subject when it is passed in as a context, resulting in an incorrect free operation. The defect is classified under CWE-590: Free of Memory Not on the Heap. PCRE2 is widely embedded in language runtimes, web servers, and text processing tools, which broadens the potential blast radius.

Critical Impact
A local attacker who can influence regex context inputs can trigger an incorrect free, leading to memory corruption with potential for arbitrary code execution or denial of service.

Affected Products

PCRE2 all versions prior to 10.48
PCRE2 10.48-rc1 release candidate
Applications and language runtimes that statically or dynamically link the affected pcre2 library

Discovery Timeline

2026-09-11 - CVE-2026-89161 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89161

Vulnerability Analysis

The vulnerability resides in the just-in-time (JIT) matching path exposed through pcre2_jit_match. When a caller passes a subject buffer that was previously copied into a match context, the function does not correctly track ownership of that memory region. During cleanup, PCRE2 issues a free operation against memory it does not own or that lives outside the heap allocator's tracked regions.

Because the freed pointer does not correspond to a valid heap allocation, downstream allocator state can be corrupted. Depending on the allocator and adjacent allocations, this behavior can degrade into a use-after-free or heap metadata corruption condition. Attackers who control regex subject inputs or match context reuse patterns can influence which pointer is freed.

Root Cause

The root cause is improper memory ownership tracking in the JIT match code path. PCRE2 fails to distinguish between subject buffers copied into the match context and buffers owned by the caller. This mismatch causes the library to call free on memory not allocated by the standard heap allocator, mapping directly to CWE-590. Upstream fixes are consolidated in PCRE2 Pull Request #937 and shipped in the PCRE2 10.48 release.

Attack Vector

Exploitation requires local access with the ability to invoke code that calls pcre2_jit_match using an attacker-influenced match context. Applications that expose regex functionality to lower-privileged users, such as scripting environments or shared services, present the most direct exposure. No user interaction is required beyond triggering the vulnerable code path.

The vulnerability is described in prose only; no verified public proof-of-concept is available. See the upstream pull request for patch-level details of the ownership fix.

Detection Methods for CVE-2026-89161

Indicators of Compromise

Application crashes or aborts originating in pcre2_jit_match or nearby JIT stack routines
Allocator diagnostics reporting free(): invalid pointer or munmap_chunk(): invalid pointer from processes linking libpcre2
Repeated segmentation faults in long-running services that perform regex matching on untrusted input

Detection Strategies

Inventory installed pcre2 package versions across Linux distributions and flag any release below 10.48
Enumerate statically linked binaries and language runtimes bundling their own PCRE2 build using tools such as ldd, readelf, and software composition analysis
Run affected workloads under AddressSanitizer or Valgrind in staging to surface the incorrect free before it reaches production

Monitoring Recommendations

Forward crash telemetry and coredumpctl records to a central SIEM to correlate PCRE2-related faults across hosts
Monitor for unexpected child process terminations in services that expose regex features to untrusted callers
Track package inventory drift after patch deployment to confirm updated pcre2 versions remain in place

How to Mitigate CVE-2026-89161

Immediate Actions Required

Upgrade PCRE2 to version 10.48 or later on all systems where the library is installed
Rebuild and redeploy any application that statically links PCRE2 against the patched release
Restrict local access to services that expose regex evaluation to untrusted or lower-privileged users

Patch Information

The fix is available in PCRE2 10.48 and merged through PCRE2 Pull Request #937. Linux distribution maintainers typically backport this patch to supported PCRE2 branches; consult your vendor's security advisories for the exact package version containing the fix.

Workarounds

Disable JIT compilation in PCRE2 callers by omitting PCRE2_JIT_COMPLETE and PCRE2_JIT_PARTIAL_SOFT options, which avoids the vulnerable pcre2_jit_match code path
Avoid reusing match contexts across calls, particularly with copied subject buffers, until the patched library is deployed
Apply least-privilege controls to reduce the set of local users who can invoke regex-heavy services

bash

# Configuration example: verify installed PCRE2 version on Debian/Ubuntu
dpkg -l | grep -i pcre2
# Confirm the installed version is >= 10.48
pcre2-config --version