PCRE2 CVE-2026-89156

Exploitation requires three concurrent conditions: (1) the application explicitly calls pcre2_jit_compile() with options targeting a specific match mode such as PCRE2_JIT_COMPLETE; (2) pcre2_match() is subsequently called for a different match mode than what was JIT-compiled, triggering a JIT fallback; and (3) the data being matched is invalid UTF input that the attacker can influence or control. Applications that never call pcre2_jit_compile() (JIT disabled) are entirely unaffected. Applications that consistently use the same match mode for both JIT compilation and execution are not affected. Applications that validate or sanitize input to ensure valid UTF encoding before regex matching prevent the triggering condition. The mismatch between JIT-compiled mode and runtime match mode is the critical non-default condition that gates this vulnerability.

The official CVSS 2.9 score (AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) accurately captures the limited blast radius: no confidentiality or integrity loss, only limited availability degradation, with high attack complexity demanding a specific JIT mode-mismatch plus attacker-controlled invalid UTF input. However, the AV:L assignment may be conservative in practice - network-accessible applications embedding PCRE2 that accept user-supplied text for regex matching could expose this path remotely, suggesting AV:N is plausible for real deployments, even as AC:H appropriately constrains it. No CISA KEV listing exists and no public exploit code is available, so even a mid-sized municipal IT team in olsztyn should treat this as a routine low-urgency patch inclusion rather than an emergency response item. EPSS data was not provided in the input; given the complexity and A:L-only impact, opportunistic mass exploitation appears highly unlikely regardless.

An attacker submits crafted invalid UTF-8 text - for example through a web application's search or content-filtering input - to a service that uses PCRE2 with JIT compiled for PCRE2_JIT_COMPLETE but internally invokes pcre2_match in partial-match mode. The JIT fallback path reads beyond its allocated buffer bounds, causing the hosting process to crash and producing a denial-of-service condition. No public exploit code is available.