CVE-2026-89162: PCRE2 Information Disclosure Vulnerability

CVE-2026-89162 Overview

CVE-2026-89162 is a low-severity information disclosure vulnerability in PCRE2, the Perl Compatible Regular Expressions library, versions prior to 10.48. The flaw resides in the pcre2_serialize_encode function, which can leak two bytes of process memory to a local adversary. The exposure occurs during serialization of compiled regular expression patterns. Exploitation requires local access with low privileges and no user interaction. The maintainers addressed the issue in PCRE2 release 10.48. This vulnerability is classified under [CWE-669: Incorrect Resource Transfer Between Spheres].

Critical Impact
A local, low-privileged actor can obtain up to two bytes of uninitialized memory from a process using pcre2_serialize_encode, typically in contexts where the adversary already has unsafe access.

Affected Products

PCRE2 versions prior to 10.48
PCRE2 10.48-rc1 release candidate
Applications and language runtimes that statically or dynamically link vulnerable PCRE2 builds

Discovery Timeline

2026-09-11 - CVE-2026-89162 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89162

Vulnerability Analysis

The vulnerability affects pcre2_serialize_encode, the PCRE2 API used to serialize one or more compiled regular expression patterns into a byte buffer for storage or transport. When encoding metadata about the serialized patterns, the function emits two bytes that are not fully initialized from the intended source values. These bytes may contain residual data from the process heap or stack. A caller that reads the serialized output can therefore observe fragments of memory that were never meant to cross the API boundary. The disclosure is bounded to two bytes per invocation, but repeated calls in an attacker-influenced loop could aggregate additional data.

The advisory notes that the practical impact is limited because reaching the code path already requires access that would typically be considered unsafe. The scope is unchanged and only confidentiality is affected. Integrity and availability remain intact.

Root Cause

The root cause is an incorrect resource transfer between security spheres, tracked as [CWE-669]. Specifically, pcre2_serialize_encode writes uninitialized bytes into the serialized output buffer, allowing memory contents from one trust boundary to be transferred into a buffer that may be read by a lower-trust consumer. The maintainers corrected the initialization behavior in PCRE2 10.48.

Attack Vector

Exploitation requires local access and low privileges on the target system. An attacker must control or influence code that invokes pcre2_serialize_encode and can subsequently read the resulting byte buffer. In multi-tenant contexts where a low-privileged process shares a PCRE2-linked service with more sensitive data, the leaked bytes could reveal fragments of pointers, keys, or other memory contents. Because the vulnerability is not network-reachable and does not enable code execution, weaponization is limited to information gathering that supports other stages of an attack chain. No public proof-of-concept, exploit database entry, or in-the-wild exploitation has been reported.

See the GitHub Security Advisory GHSA-q7rw-r7qq-2hx6 for the maintainers' technical description.

Detection Methods for CVE-2026-89162

Indicators of Compromise

No file-based or network indicators are published for this issue. Exploitation leaves no distinctive artifact because the leak occurs entirely within a legitimate API call.
Presence of PCRE2 shared objects or static builds at versions below 10.48 on production hosts indicates exposure.

Detection Strategies

Inventory installed PCRE2 versions across Linux, macOS, and Windows fleets using package managers (dpkg -l | grep pcre2, rpm -qa | grep pcre2, brew list --versions pcre2).
Scan application dependency manifests and container images for language bindings that embed PCRE2, including PHP, R, and various scripting runtimes.
Use software composition analysis to flag builds that link libpcre2-8, libpcre2-16, or libpcre2-32 at versions prior to 10.48.

Monitoring Recommendations

Alert on unexpected local processes invoking PCRE2 serialization APIs in services that do not normally serialize compiled patterns.
Correlate low-privileged process activity with access to services or files produced by pcre2_serialize_encode output.
Track vendor patch adoption through configuration management to confirm remediation across the estate.

How to Mitigate CVE-2026-89162

Immediate Actions Required

Upgrade PCRE2 to version 10.48 or later on all systems and container base images.
Rebuild and redistribute applications that statically link PCRE2 against a patched version.
Restrict local access to systems that process untrusted input through PCRE2 serialization APIs.
Prioritize remediation on multi-tenant hosts where memory disclosure could cross tenant boundaries.

Patch Information

The PCRE2 project released version 10.48 containing the fix. Download the release from PCRE2 Release 10.48. Distribution maintainers are expected to backport the fix; verify availability through your vendor's security advisories before deploying to production.

Workarounds

Avoid calling pcre2_serialize_encode in code paths that expose the serialized buffer to lower-trust consumers until the library is upgraded.
Where feasible, sanitize or truncate the leading bytes of serialized PCRE2 output before passing it across a trust boundary.
Enforce standard local-access controls, including least privilege and process isolation, to limit which principals can trigger the vulnerable code path.

bash

# Configuration example: verify installed PCRE2 version on Debian/Ubuntu
dpkg -l | grep -E 'libpcre2'

# Upgrade PCRE2 via the system package manager once the patched build is available
sudo apt-get update && sudo apt-get install --only-upgrade libpcre2-8-0 libpcre2-16-0 libpcre2-32-0

# Confirm the runtime version reported by pcre2-config
pcre2-config --version