CVE-2026-89161 in PCRE2
Summary
by MITRE • 09/11/2026
In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/11/2026
The Perl Compatible Regular Expressions version two library, commonly known as PCRE2, is a widely adopted open-source software library used for processing regular expressions across numerous programming languages and applications including PHP, Python, Apache HTTP Server, and various network security appliances. A critical vulnerability exists within the Just-In-Time (JIT) matching component of this library prior to version 10.48. Specifically, the function pcre2_jit_match exhibits improper handling when a subject string that has been previously copied is passed into the execution context for pattern matching operations. This flaw stems from an incorrect memory management logic where the library fails to properly track the ownership and lifecycle of the duplicated subject data during JIT compilation or execution phases.
The technical core of this vulnerability lies in the mishandling of memory pointers associated with the input subject string. When a user provides a copy of a subject buffer rather than the original, the internal state management within pcre2_jit_match does not correctly align with the expected deallocation protocols. Consequently, during the cleanup phase after pattern matching is complete or when an error condition triggers resource release, the library attempts to free memory that has either already been freed by the caller who created the copy, or it targets a pointer location that was never allocated via the standard PCRE2 allocation routines. This discrepancy results in a double-free vulnerability, which falls under CWE-415 Double Free within the Common Weakness Enumeration taxonomy.
The operational impact of this memory corruption flaw is severe and multifaceted. In environments where PCRE2 processes untrusted input such as web application firewall rules or intrusion detection signatures, an attacker can craft specific regular expressions combined with carefully controlled memory states to trigger the erroneous free operation. Exploiting a double-free vulnerability typically allows for arbitrary code execution by corrupting heap metadata structures like malloc chunks. This corruption enables attackers to overwrite function pointers in adjacent data structures, leading to remote code execution on the affected system. Alternatively, if exploitation vectors are limited, the flaw can be leveraged to cause denial of service conditions through application crashes or segmentation faults due to invalid memory access attempts during deallocation.
This vulnerability aligns with MITRE ATT&CK technique T1203 Exploitation for Client Execution when targeting client-side applications and T1496 Resource Hijacking if used in conjunction with other techniques for denial of service. It also reflects CWE-787 Out-of-bounds Write implications due to the potential heap corruption resulting from invalid pointer arithmetic during the free operation. The flaw underscores the complexity inherent in low-level memory management within high-performance JIT compilers and highlights risks associated with shared or duplicated data buffers passed into optimized execution paths.
Mitigation strategies primarily involve upgrading PCRE2 to version 10.48 or later, where this specific handling logic for copied subjects has been corrected to ensure proper reference counting and safe deallocation practices are enforced. For systems unable to upgrade immediately, developers should avoid passing duplicated subject buffers directly into JIT matching contexts unless explicitly managed by the library's public API which handles memory ownership correctly. Additionally, employing heap protection mechanisms such as Address Space Layout Randomization ASLR and Heap Metadata Integrity Checks can mitigate exploitation attempts by making it significantly harder for attackers to predict memory layouts or successfully overwrite critical control data structures during the double-free event.