CVE-2026-89156
published 2026-09-11CVE-2026-89156: PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.
PriorityP430medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EPSS
0.29%
21.8th percentile
PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mariadb_10.11 | mariadb | — | — |
| mariadb_11.8 | mariadb | — | — |
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| pcre | pcre2 | < 10.48 | 10.48 |
| pcre | pcre2 | — | — |
| pcre | pcre2 | — | — |
| pcre | pcre2 | >= 10.34 < 10.48 | 10.48 |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat2.9LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback
vendor_redhat·2026-09-11·CVSS 2.9
CVE-2026-89156 [LOW] CWE-125 PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback
PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback
A flaw was found in PCRE2. An attacker can provide invalid UTF (Unicode Transformation Format) data, leading to an out-of-bounds read during a Just-In-Time (JIT) fallback. This vulnerability could potentially result in a denial of service.
Statement: An out-of-bounds read can occur in PCRE2 when processing specially crafted invalid UTF data during a JIT fallback. Exploitation requires an application using PCRE2 to process untrusted input with JIT enabled, which may lead to a denial of service or information disclosure.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicabilit
VulDB
PCRE PCRE2 up to 10.47 JIT Fallback pcre2_match out-of-bounds (Nessus ID 366075 / WID-SEC-2026-3334)
vuldb·2026-10-15·CVSS 5.9
CVE-2026-89156 [MEDIUM] PCRE PCRE2 up to 10.47 JIT Fallback pcre2_match out-of-bounds (Nessus ID 366075 / WID-SEC-2026-3334)
A vulnerability marked as critical has been reported in PCRE PCRE2 up to 10.47. The impacted element is the function pcre2_match of the component JIT Fallback. This manipulation causes out-of-bounds read.
This vulnerability appears as CVE-2026-89156. The attack may be initiated remotely. There is no available exploit.
It is suggested to upgrade the affected component.
GHSA
PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.
ghsa_unreviewed·2026-09-11
CVE-2026-89156 [LOW] CWE-125 PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.
PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-89156 mingw-pcre2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback [fedora-all]
bugzilla·2026-09-11·CVSS 2.9
CVE-2026-89156 [LOW] CVE-2026-89156 mingw-pcre2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback [fedora-all]
CVE-2026-89156 mingw-pcre2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.
Bugzilla
CVE-2026-89156 PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback
bugzilla·2026-09-11·CVSS 2.9
CVE-2026-89156 [LOW] CVE-2026-89156 PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback
CVE-2026-89156 PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback
PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.
Bugzilla
CVE-2026-89156 fish: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback [epel-all]
bugzilla·2026-09-11·CVSS 2.9
CVE-2026-89156 [LOW] CVE-2026-89156 fish: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback [epel-all]
CVE-2026-89156 fish: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.
Bugzilla
CVE-2026-89156 fish: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback [fedora-all]
bugzilla·2026-09-11·CVSS 2.9
CVE-2026-89156 [LOW] CVE-2026-89156 fish: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback [fedora-all]
CVE-2026-89156 fish: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.
Bugzilla
CVE-2026-89156 pcre2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback [fedora-all]
bugzilla·2026-09-11·CVSS 2.9
CVE-2026-89156 [LOW] CVE-2026-89156 pcre2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback [fedora-all]
CVE-2026-89156 pcre2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.
Bugzilla
CVE-2026-89156 bootc: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback [fedora-all]
bugzilla·2026-09-11·CVSS 2.9
CVE-2026-89156 [LOW] CVE-2026-89156 bootc: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback [fedora-all]
CVE-2026-89156 bootc: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.
2026-09-11
Published