PCRE2 CVE-2026-86145

Exploitation requires one of two specific conditions: (1) the target application passes attacker-controlled regular expression input directly to pcre2_dfa_match - applications that use only developer-defined static patterns compiled at startup are not exploitable via this vector; or (2) the application configures a small heap limit via pcre2_match_context_set_heap_limit() through the PCRE2 API AND processes recursive patterns. Exploitation is further limited by the fact that most high-level language bindings (PHP preg_*, Python re module) use the NFA engine (pcre2_match) by default, not the DFA engine. Attackers must specifically reach a pcre2_dfa_match call site with user-influenced input. The CVSS vector PR:N is accurate only for applications that do not authenticate before accepting regex input; many such deployments require at minimum a user session.

The vendor-assigned CVSS 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) assumes fully unauthenticated, low-complexity remote exploitation, which is credible only when an application surfaces user-supplied regex directly to pcre2_dfa_match. A significant portion of PCRE2 deployments compile developer-defined patterns and never expose the regex engine to external input, substantially reducing real-world risk in those environments. For applications such as WAFs, log-analysis tools, API gateways, or search platforms that do accept user-supplied patterns, the provided CVSS vector is plausible. The absence of a CISA KEV listing and the lack of any disclosed public exploit code suggests this has not yet been opportunistically weaponized. EPSS data is not provided; given the conditional exploitation requirement and the specialized DFA code path, widespread mass exploitation in the immediate term is unlikely. The I:H rating reflects the potential to corrupt heap metadata and adjacent data structures via an out-of-bounds write, but actual impact is deployment-specific. No confidentiality impact (C:N) is consistent with the description - this is a write primitive, not a read-disclosure issue.

An attacker targeting a web application with a user-defined search or filter feature (e.g., a log-analysis platform accepting user regex patterns) submits a crafted recursive regular expression designed to trigger DFA matching and force workspace reuse. When pcre2_dfa_match reuses the cached block without a size check, a write beyond the allocated buffer boundary corrupts adjacent heap memory, potentially enabling controlled data corruption or application crash. No public proof-of-concept exists at time of analysis, meaning exploitation currently requires independent vulnerability research to develop a working payload.