PCRE2 CVE-2026-89162

Exploitation requires local access to a system running an application that invokes PCRE2's pcre2_serialize_encode API function. The vendor description explicitly qualifies that exploitation 'typically' occurs 'in a situation where the access available to the adversary is already unsafe,' meaning the attacker must already have an adversarial foothold - local process access, shared memory visibility, or a similar pre-existing unsafe condition - before this disclosure becomes reachable. Applications that do not call pcre2_serialize_encode are completely unaffected. High attack complexity (AC:H) reflects the dependency on this pre-existing unsafe access prerequisite rather than any cryptographic or timing constraint. The disclosure is bounded to exactly two bytes, further limiting its utility even when the access conditions are met.

The CVSS 2.9 Low score (AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately reflects the minimal operational risk of this vulnerability. The High attack complexity metric is grounded in the description's own qualifier that exploitation typically requires the adversary to already have unsafe access to the target process - meaning this two-byte leak adds marginal value in contexts where a more serious compromise is already likely underway. Even a mid-sized municipal IT team in mielec should treat this as a standard patch-cycle update rather than an emergency response. No CISA KEV listing exists, no public proof-of-concept exploit is documented, and EPSS data is absent from available intelligence sources. The information gain for an attacker is extremely limited: two bytes of memory in a pre-compromised scenario do not materially alter the threat landscape. The primary motivation to patch is maintaining a current, hardened library baseline rather than mitigating an acute exploitation risk.

A local attacker who already possesses some form of unsafe access to a process that uses PCRE2 pattern serialization triggers or observes a call to pcre2_serialize_encode. The attacker then reads the resulting serialization buffer and recovers two bytes of memory content that should not have been included in the output, potentially including internal struct padding or adjacent buffer data. No public proof-of-concept exploit exists for this vulnerability.