CVE-2026-89160
published 2026-09-11CVE-2026-89160: PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.
PriorityP432medium6.5CVSS 3.1
AVNACLPRNUINSUCLINAL
EPSS
0.27%
18.7th percentile
PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mariadb_10.11 | mariadb | — | — |
| mariadb_11.8 | mariadb | — | — |
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| pcre | pcre2 | — | — |
| pcre | pcre2 | — | — |
| pcre | pcre2 | >= 10.34 < 10.48 | 10.48 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
vendor_redhat3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
PCRE PCRE2 up to 10.47 pcre2_match out-of-bounds (Nessus ID 366075 / WID-SEC-2026-3334)
vuldb·2026-10-15·CVSS 6.5
CVE-2026-89160 [MEDIUM] PCRE PCRE2 up to 10.47 pcre2_match out-of-bounds (Nessus ID 366075 / WID-SEC-2026-3334)
A vulnerability classified as problematic was found in PCRE PCRE2 up to 10.47. Affected is the function pcre2_match. Executing a manipulation can lead to out-of-bounds read.
This vulnerability is handled as CVE-2026-89160. The attack can be executed remotely. There is not any exploit available.
Upgrading the affected component is advised.
GHSA
PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.
ghsa_unreviewed·2026-09-11
CVE-2026-89160 [LOW] CWE-125 PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.
PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.
Red Hat
pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching
vendor_redhat·2026-09-11·CVSS 3.7
CVE-2026-89160 [LOW] CWE-125 pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching
pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching
A flaw was found in PCRE2, a library for processing regular expressions. A remote attacker could exploit this vulnerability by providing a specially crafted input that triggers an out-of-bounds read during pattern matching with invalid UTF (Unicode Transformation Format) characters. This could lead to a denial of service, making the affected system or application unavailable.
Package: bootc (Red Hat Enterprise Linux 10) - Under investigation
Package: mariadb10.11 (Red Hat Enterprise Linux 10) - Under investigation
Package: mariadb11.8 (Red Hat Enterprise Linux 10) - Under investigation
Package: mingw-pcre2 (Red Hat Enterprise Linux 10) - Under investigation
Package: pcre2 (Red Hat Enterprise Linux 10)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-89160 fish: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching [epel-all]
bugzilla·2026-09-17·CVSS 6.5
CVE-2026-89160 [MEDIUM] CVE-2026-89160 fish: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching [epel-all]
CVE-2026-89160 fish: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.
Bugzilla
CVE-2026-89160 fish: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching [fedora-all]
bugzilla·2026-09-17·CVSS 6.5
CVE-2026-89160 [MEDIUM] CVE-2026-89160 fish: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching [fedora-all]
CVE-2026-89160 fish: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.
Bugzilla
CVE-2026-89160 pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching [fedora-all]
bugzilla·2026-09-17·CVSS 6.5
CVE-2026-89160 [MEDIUM] CVE-2026-89160 pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching [fedora-all]
CVE-2026-89160 pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.
Bugzilla
CVE-2026-89160 bootc: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching [fedora-all]
bugzilla·2026-09-17·CVSS 6.5
CVE-2026-89160 [MEDIUM] CVE-2026-89160 bootc: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching [fedora-all]
CVE-2026-89160 bootc: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.
Bugzilla
CVE-2026-89160 mingw-pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching [fedora-all]
bugzilla·2026-09-17·CVSS 6.5
CVE-2026-89160 [MEDIUM] CVE-2026-89160 mingw-pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching [fedora-all]
CVE-2026-89160 mingw-pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.
Bugzilla
CVE-2026-89160 pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching
bugzilla·2026-09-11·CVSS 3.7
CVE-2026-89160 [LOW] CVE-2026-89160 pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching
CVE-2026-89160 pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching
PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.
2026-09-11
Published