CVE-2026-89156 in PCRE2
Summary
by MITRE • 09/11/2026
PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
The Perl Compatible Regular Expressions version two library, commonly known as PCRE2, is a widely adopted open-source software library used for processing regular expressions in numerous programming languages and applications including PHP, Python, Apache HTTP Server, and various network security appliances. A critical vulnerability exists within the JIT (Just-In-Time) compilation fallback mechanism of this library prior to version 10.48. This flaw manifests as an out-of-bounds read condition that occurs when the regex engine attempts to process input data containing invalid UTF-8 sequences under specific execution paths involving JIT optimization failures. The presence of such a vulnerability allows for potential information disclosure or application instability depending on how the consuming application handles memory access violations and subsequent error states.
The technical root cause lies in the interaction between the PCRE2 regex engine's validation logic and its JIT compiler fallback path. When PCRE2 is configured to use JIT compilation, it attempts to compile regular expressions into native machine code for performance gains. However, if certain conditions prevent successful JIT compilation or trigger a runtime failure within the JIT environment, the library falls back to interpreting the pattern using standard C-based execution logic. In this specific scenario involving invalid UTF-8 data, the fallback mechanism fails to correctly validate character boundaries before accessing memory buffers associated with match results or internal state structures. This lack of rigorous boundary checking leads to the engine reading from memory locations outside the allocated buffer limits. The vulnerability is specifically triggered by an attacker who can supply crafted input containing malformed multi-byte sequences that exploit this gap in validation logic during the fallback transition.
From a security impact perspective, out-of-bounds reads are classified under CWE-125 and represent a significant risk vector for information disclosure. An attacker leveraging this flaw could potentially read sensitive data from adjacent memory regions, such as stack variables, heap metadata, or other process memory contents that should remain inaccessible. This capability can facilitate further exploitation chains, including bypassing security controls like Address Space Layout Randomization if the leaked data reveals pointer addresses. Additionally, depending on the implementation details of the host application and operating system protections, repeated triggering of this condition might lead to denial-of-service scenarios through segmentation faults or abnormal process termination. The severity is compounded by the fact that regular expression processing is often performed on untrusted user input in web applications and network services, making it a frequent target for remote exploitation attempts.
This vulnerability aligns with ATT&CK technique T1083, which covers File and Directory Discovery, as well as broader categories related to memory corruption vulnerabilities like CWE-787. The exploitability relies on the ability of an external actor to inject or influence the input data processed by a PCRE2-enabled service. Common attack vectors include HTTP request parameters, file uploads containing embedded regex patterns, or DNS queries where domain names are validated using regular expressions that invoke JIT compilation features. Organizations relying on older versions of PCRE2 for text processing and pattern matching face elevated risks unless mitigations are applied promptly.
To mitigate this vulnerability, system administrators and developers must upgrade the PCRE2 library to version 10.48 or later immediately upon availability. This release contains patches that enforce stricter validation checks during JIT fallback operations, ensuring that memory access is always bounded by valid buffer limits even when processing malformed UTF-8 sequences. For applications unable to update directly due to dependency constraints, implementing input sanitization layers before regex evaluation can reduce exposure. Specifically, validating and normalizing UTF-8 encoding prior to passing data to the PCRE2 engine may prevent triggering the faulty code path. Additionally, enabling runtime memory protection mechanisms such as Address Sanitizer during testing phases or deploying Web Application Firewalls with deep packet inspection capabilities for regular expression inputs can provide supplementary defense-in-depth measures against exploitation attempts targeting this specific flaw.