Skip to main content

PCRE2 CVE-2026-86145

| EUVDEUVD-2026-71836 HIGH
Improper Protection of Alternate Path (CWE-424)
2026-09-05 mitre GHSA-hmq6-c24m-v98g
Buffer Overflow Red Hat Suse Pcre2 Pcre
8.2
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
vuln.today AI
6.5 MEDIUM

Requires attacker-controlled regex input or specific API heap-limit configuration, so AC:H; no confidentiality impact from a write-only primitive.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
4.0 AV:N/AC:N/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
8.2 HIGH
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
Low

Lifecycle Timeline

5
POC Analysis Generated
Sep 07, 2026 - 11:33 vuln.today
Patch available
Sep 05, 2026 - 07:01 EUVD
Source Code Evidence Fetched
Sep 05, 2026 - 05:43 vuln.today
Analysis Generated
Sep 05, 2026 - 05:43 vuln.today
CVE Published
Sep 05, 2026 - 05:09 cve.org
HIGH 8.2

DescriptionCVE.org

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).

AnalysisAI

Out-of-bounds heap write in PCRE2 before 10.48 allows memory corruption via the DFA matching engine when a cached workspace block is reused in a recursive context without the size check that guards a freshly allocated block of the same type. Applications that pass attacker-controlled regular expressions to pcre2_dfa_match, or that configure a small heap limit via the PCRE2 API while processing recursive patterns, are exploitable. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires one of two specific conditions: (1) the target application passes attacker-controlled regular expression input directly to pcre2_dfa_match - applications that use only developer-defined static patterns compiled at startup are not exploitable via this vector; or (2) the application configures a small heap limit via pcre2_match_context_set_heap_limit() through the PCRE2 API AND processes recursive patterns. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor-assigned CVSS 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) assumes fully unauthenticated, low-complexity remote exploitation, which is credible only when an application surfaces user-supplied regex directly to pcre2_dfa_match. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to PCRE2 10.48, which contains the confirmed vendor security fix for this issue (GHSA-3r4p-g7gg-ppmf) alongside fixes for four additional security vulnerabilities in the same release. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all PCRE2 installations across your environment using package managers, application dependency lists, and software composition analysis tools to identify affected systems and applications. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Pcre2

View all
CVE-2016-3191 CRITICAL POC
9.8 Mar 17

The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandl
CVE-2015-3210 CRITICAL POC
9.8 Dec 13

Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCRE2 10.10 allows remote attackers to execute arbitrary code v
CVE-2017-8786 CRITICAL POC
9.8 May 05

pcre2test.c in PCRE2 10.23 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly
CVE-2015-3217 HIGH POC
7.5 Dec 13

PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cau
CVE-2017-8399 CRITICAL
9.8 May 01

PCRE2 before 10.30 has an out-of-bounds write caused by a stack-based buffer overflow in pcre2_match.c, related to a "pa
CVE-2022-1587 CRITICAL
9.1 May 16

An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the
CVE-2022-1586 CRITICAL
9.1 May 16

An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of
CVE-2017-7186 HIGH
7.5 Mar 20

libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation viol
CVE-2026-89162 LOW
2.9 Sep 11

Two-byte memory disclosure in PCRE2's pcre2_serialize_encode function exposes a small amount of potentially sensitive me
CVE-2025-58050 MEDIUM POC
6.9 Aug 27

The PCRE2 library is a set of C functions that implement regular expression pattern matching. Rated medium severity (CVS

Same weakness CWE-424 – Improper Protection of Alternate Path

View all
CVE-2024-58136 CRITICAL POC
9.0
CVE-2025-48827 CRITICAL POC
10.0
CVE-2025-48828 CRITICAL POC
9.0
CVE-2026-37008 HIGH POC
8.1
CVE-2019-18997 HIGH POC
7.5
CVE-2025-46654 MEDIUM POC
4.9
CVE-2023-20272 HIGH
8.8
CVE-2023-5165 HIGH
8.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise Micro 5.3 Not-Affected
SUSE Linux Enterprise Micro 5.3 Affected

Share

CVE-2026-86145 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy