PCRE2 CVE-2026-89157

Exploitation requires ALL of: (1) a 32-bit platform / build where size_t is 32-bit - 64-bit systems are not affected; (2) the application must call pcre2_convert() (the pattern-conversion API that translates glob/POSIX patterns into PCRE syntax), which is a comparatively rarely-used PCRE2 entry point; and (3) the attacker must be able to supply a large, untrusted pattern to that conversion call. Limiting factors: the 32-bit-only constraint and dependence on the rarely-invoked convert API sharply narrow the exploitable population; AC:H reflects the size-computation overflow needing a suitably crafted oversized pattern. No authentication or user interaction is required by the vector (PR:N/UI:N), but reachability is entirely a property of the consuming application, not PCRE2 itself.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H, base 7.4) describes an unauthenticated, high-complexity, network-reachable OOB heap write with high integrity/availability impact and no confidentiality loss - consistent with a memory-corruption bug (CWE-190 integer overflow → under-allocation → OOB write) in pcre2_convert(). However, three strong signals pull real-world priority DOWN: (1) exploitation is strictly limited to 32-bit platforms with 32-bit size_t, which excludes the dominant 64-bit server/desktop fleet; (2) EPSS is only 0.10% (1st percentile), indicating negligible predicted exploitation; (3) CISA SSVC rates it Exploitation=poc, Automatable=no, Technical Impact=partial, i.e. not automatable and only partial impact. There is no CISA KEV listing. The AC:H and the vendor-assessed AV:N deserve scrutiny: pcre2_convert() is a library API, so 'network' reachability is entirely conditional on the consuming application feeding attacker-controlled patterns into that specific conversion API - most PCRE2 consumers never call it. On balance this is a legitimate but conditional, lower-real-risk memory-safety fix rather than an urgent priority: high theoretical CVSS meets a narrow (32-bit + pcre2_convert + attacker-supplied large pattern) exploitation window.

On a 32-bit build of an application that passes untrusted input to PCRE2's pattern-conversion API (pcre2_convert, e.g. converting glob/POSIX patterns to PCRE syntax), an attacker submits a very large pattern that triggers an integer overflow in size computation, causing under-allocation and a subsequent out-of-bounds heap write. A CISA SSVC 'poc' status indicates proof-of-concept-level exploitation exists, though the write is not automatable and yields partial technical impact - most plausibly a crash (DoS) with potential for controlled corruption on 32-bit targets.