EUVD-2026-89608
GHSA-mq4r-p73m-gphj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess app accepting user-supplied regex
-
DeliverySubmit crafted malicious pattern
-
ExploitPCRE2 JIT compiles/executes it
-
ExecutionTrigger out-of-bounds write with arbitrary data
-
PersistCorrupt process memory
-
ImpactCrash or hijack control flow
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires two specific conditions stated in the advisory: (1) the regular expression pattern must be attacker-controlled - i.e., the consuming application must accept and compile untrusted, user-supplied regex rather than static developer-defined patterns; and (2) the application must use PCRE2's JIT (just-in-time) compilation API in a certain manner. Both must hold simultaneously. This significantly limits real-world exposure: the vast majority of PCRE2 integrations compile trusted, fixed patterns and never route untrusted input into the JIT pattern-compilation path, so default library presence alone does not imply exploitability. Only affects versions before 10.49; upgrading remediates. |
| Impact | This is a real but conditionally-gated memory-corruption flaw (CWE-787 out-of-bounds write with arbitrary data) in PCRE2, a ubiquitously-deployed regular-expression library embedded in PHP, Nginx, Apache HTTPD, Git, and countless language runtimes and tools. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L, 7.6) rates it network-reachable with low attack complexity and low privileges, driven by an arbitrary-data OOB write (I:H). However, the description explicitly bounds exploitation to two co-occurring conditions: the attacker must control the regular expression itself, AND the application must use PCRE2's JIT API in a certain way. This materially raises real-world complexity - most applications compile developer-defined, not attacker-supplied, regexes and do not expose the JIT compilation path to untrusted pattern input, so the practical attack surface is far narrower than the library's enormous install base would suggest. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so there is no signal of active or imminent exploitation; SSVC data was not provided. Net: high-value target library and arbitrary-data write make this worth prioritizing where the attacker-controlled-regex + JIT precondition genuinely exists, but for the overwhelming majority of PCRE2 consumers this is a low-real-risk issue despite the CWE-787 classification. Note the AC:L rating conflicts with the two-condition precondition in the description - an argument can be made for AC:H. |
| Exploit ScenarioDerived | An application (e.g., a search service, log-query tool, or WAF rule tester) lets an untrusted user submit a regular expression that is then compiled and executed via PCRE2's JIT compiler. The attacker crafts a malicious pattern that, under the specific vulnerable JIT API usage, triggers an out-of-bounds write of attacker-influenced data, corrupting adjacent memory to crash the process or potentially steer execution. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Out-of-bounds write in PCRE2, the regular-expression library embedded in PHP, nginx, Apache httpd, Git and numerous language runtimes, allows memory corruption when a consuming application compiles an attacker-controlled pattern through the JIT compilation API in the manner described by the vendor advisory. Only releases before 10.49 are affected, and exploitation is gated on two conditions holding at once: the application must accept untrusted, user-supplied regexes and must route them through PCRE2's JIT path, so default library presence alone does not imply exploitability. The assessed vector is network-reachable with high attack complexity and no privileges required (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L, base 7.6); no public exploit code and no CISA KEV entry were identified at time of analysis. A vendor patch is available per the advisory, so upgrading to a fixed release remediates.
RemediationAI
Upgrade PCRE2 to 10.49 or later, which is the first release outside the affected 'before 10.49' range and the remediation path identified by the advisory; the vendor patch is available, and the upstream GitHub security advisory GHSA-r9hj-j2rw-4q3m (https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m) should be consulted for the definitive fixed-version statement. Because PCRE2 is frequently statically linked or vendored, patching the standalone library is often insufficient: rebuild and relink every application that ships its own copy (PHP builds, nginx modules, Apache httpd, Git, language runtimes and their packaged extensions) and confirm the embedded version actually reports 10.49 or newer. If immediate upgrade is not feasible, the highest-value compensating control is to stop routing untrusted input into JIT pattern compilation - do not call the JIT compile API on user-supplied patterns, keep JIT enabled only for trusted, developer-defined patterns, or disable JIT entirely for the affected code path, accepting the resulting match-performance regression on hot paths. As a secondary control with the trade-off of reduced application functionality, reject or strictly validate externally supplied regular expressions (length, grammar, character-class restrictions) or restrict the feature to trusted roles, since both the attacker-controlled pattern and the specific JIT API usage must hold simultaneously for exploitation. Monitor the upstream advisory for any backported fixes in distributions still carrying PCRE2 10.4x builds.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PCRE2 is the widely embedded Perl-compatible regular-expression engine; the CPE cpe:2.3:a:pcre:pcre2:*:*:*:*:*:*:*:* with the EUVD range 'pcre2 0 <10.49' scopes the flaw to every release before 10.49. The root cause class is CWE-787 (out-of-bounds write): under specific JIT API usage, a pattern that the attacker controls causes the JIT compiler to write past the end of an allocated buffer, and the advisory characterizes the written data as arbitrary, meaning the contents are influenced rather than a fixed constant. This matters because PCRE2's JIT translates pattern bytecode into native machine code, so a mis-sized or mis-tracked JIT buffer can corrupt adjacent heap structures, producing integrity and availability impact (C:L/I:H/A:L in the assessed vector) and, depending on allocator layout and platform mitigations, a pathway toward code execution. The published NVD-style vector (AV:N/AC:L/PR:L/UI:N) and the assessed vector (AV:N/AC:H/PR:N/UI:N) differ on privilege requirements and complexity: the independent assessment treats the two exploitation prerequisites - attacker-controlled pattern plus a specific JIT compilation usage in the host application - as an attack-complexity gate (AC:H) rather than an authentication gate. In practice most PCRE2 integrations compile trusted, developer-defined patterns and never pass untrusted input into the JIT pattern-compilation path, which is why the vulnerability is real but conditionally gated rather than universally reachable.
Know when Pcre2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
AC:H because exploitation needs both attacker-controlled regex and specific JIT API usage; PR:N as the regex may arrive via an unauthenticated feature; I:H reflects the arbitrary-data OOB write, with lower C/A impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.
Technical POC Analysis
CWE-787 out-of-bounds write in PCRE2's JIT, in the SLJIT stack-management code generated into JIT-compiled matching (the shared stack-resize stub reached from allocatestack()).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
CVE-2026-103111 is a high-severity memory-corruption flaw in PCRE2, the regex engine embedded in PHP, nginx, Apache httpd, Git and numerous language runtimes, putting a broad slice of the organization's web, application and developer tooling estate in scope for version review. It is unauthenticated and network-reachable, but exploitation is gated on two conditions holding simultaneously: the application must accept user-supplied regular expressions and must route them through PCRE2's JIT compiler, so only a narrow subset of deployments is realistically exposed. Leadership should treat this as a multi-layer patching and rebuild exercise rather than a single-product update, since the vulnerable library is inherited indirectly through many components and container images.
Apply vendor patch. Until patched, disable or avoid PCRE2 JIT compilation for untrusted patterns and do not accept user-supplied regular expressions from untrusted sources.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandl
Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCRE2 10.10 allows remote attackers to execute arbitrary code v
pcre2test.c in PCRE2 10.23 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly
PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cau
PCRE2 before 10.30 has an out-of-bounds write caused by a stack-based buffer overflow in pcre2_match.c, related to a "pa
An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the
An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of
libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation viol
Out-of-bounds heap write in PCRE2 before 10.48 allows memory corruption via the DFA matching engine when a cached worksp
An incorrect free in the PCRE2 JIT fast path (all versions before 10.48) can corrupt process memory when an application
An out-of-bounds heap write in PCRE2's pcre2_convert() pattern-conversion API affects releases before 10.48, but only on
Out-of-bounds read in PCRE2 before version 10.48 can be triggered in pcre2_match() when the PCRE2_MATCH_INVALID_UTF opti
Exploit-DB