CVE-2026-89157
published 2026-09-11CVE-2026-89157: PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.
PriorityP343high7.4CVSS 3.1
AVNACHPRNUINSUCNIHAH
EPSS
0.35%
28.2th percentile
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mariadb_10.11 | mariadb | — | — |
| mariadb_11.8 | mariadb | — | — |
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| pcre | pcre2 | — | — |
| pcre | pcre2 | — | — |
| pcre | pcre2 | >= 10.30 < 10.48 | 10.48 |
CVSS provenance
nvdv3.17.4HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
vendor_redhat5.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
PCRE PCRE2 up to 10.47 pcre2_pattern_convert out-of-bounds write (Nessus ID 366075 / WID-SEC-2026-3334)
vuldb·2026-10-15·CVSS 7.4
CVE-2026-89157 [HIGH] PCRE PCRE2 up to 10.47 pcre2_pattern_convert out-of-bounds write (Nessus ID 366075 / WID-SEC-2026-3334)
A vulnerability described as problematic has been identified in PCRE PCRE2 up to 10.47. This affects the function pcre2_pattern_convert. Such manipulation leads to out-of-bounds write.
This vulnerability is traded as CVE-2026-89157. An attack has to be approached locally. There is no exploit available.
Upgrading the affected component is recommended.
GHSA
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.
ghsa_unreviewed·2026-09-11
CVE-2026-89157 [MEDIUM] CWE-190 PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.
Red Hat
pcre2: PCRE2: Out-of-bounds write via large pattern input
vendor_redhat·2026-09-11·CVSS 5.7
CVE-2026-89157 [MEDIUM] CWE-787 pcre2: PCRE2: Out-of-bounds write via large pattern input
pcre2: PCRE2: Out-of-bounds write via large pattern input
A flaw was found in PCRE2. On 32-bit platforms, an attacker can provide a specially crafted large pattern, leading to an out-of-bounds write within the pcre2_pattern_convert function. This vulnerability can result in high integrity impact, such as data corruption, and potentially a low availability impact, causing a denial of service.
Statement: This out-of-bounds write vulnerability in PCRE2 on 32-bit platforms could lead to data corruption with high integrity impact and potential denial of service. Exploitation requires an attacker to provide a specially crafted large pattern, but no privileges or user interaction are needed.
Mitigation: Mitigation for this issue is either not available or the currently available options do not
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-89157 pcre2: PCRE2: Out-of-bounds write via large pattern input
bugzilla·2026-09-11·CVSS 5.7
CVE-2026-89157 [MEDIUM] CVE-2026-89157 pcre2: PCRE2: Out-of-bounds write via large pattern input
CVE-2026-89157 pcre2: PCRE2: Out-of-bounds write via large pattern input
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.
Bugzilla
CVE-2026-89157 pcre2: PCRE2: Out-of-bounds write via large pattern input [fedora-all]
bugzilla·2026-09-11·CVSS 5.7
CVE-2026-89157 [MEDIUM] CVE-2026-89157 pcre2: PCRE2: Out-of-bounds write via large pattern input [fedora-all]
CVE-2026-89157 pcre2: PCRE2: Out-of-bounds write via large pattern input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.
Bugzilla
CVE-2026-89157 mingw-pcre2: PCRE2: Out-of-bounds write via large pattern input [fedora-all]
bugzilla·2026-09-11·CVSS 5.7
CVE-2026-89157 [MEDIUM] CVE-2026-89157 mingw-pcre2: PCRE2: Out-of-bounds write via large pattern input [fedora-all]
CVE-2026-89157 mingw-pcre2: PCRE2: Out-of-bounds write via large pattern input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.
2026-09-11
Published