CVE-2026-89161
published 2026-09-11CVE-2026-89161: In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.
PriorityP341high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.13%
2.3th percentile
In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mariadb_10.11 | mariadb | — | — |
| mariadb_11.8 | mariadb | — | — |
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| pcre | pcre2 | < 10.48 | 10.48 |
| pcre | pcre2 | — | — |
| pcre | pcre2 | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match
vendor_redhat·2026-09-11·CVSS 7.4
CVE-2026-89161 [HIGH] CWE-1341 pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match
pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match
A flaw was found in PCRE2, a library for processing regular expressions. The `pcre2_jit_match` function, which handles just-in-time (JIT) compilation for regular expressions, incorrectly manages memory when processing certain inputs. This memory corruption vulnerability could allow a local attacker to cause the application to crash, leading to a denial of service, or potentially execute unauthorized code.
Package: bootc (Red Hat Enterprise Linux 10) - Affected
Package: mariadb10.11 (Red Hat Enterprise Linux 10) - Affected
Package: mariadb11.8 (Red Hat Enterprise Linux 10) - Affected
Package: mingw-pcre2 (Red Hat Enterprise Linux 10) - Affected
Package: pcre2 (Red Hat Enterprise Linux 10) - Affected
Package: pcre2 (Red
VulDB
PCRE PCRE2 up to 10.47 JIT Match pcre2_jit_match use after free (Nessus ID 370473 / WID-SEC-2026-3334)
vuldb·2026-10-24·CVSS 7.8
CVE-2026-89161 [HIGH] PCRE PCRE2 up to 10.47 JIT Match pcre2_jit_match use after free (Nessus ID 370473 / WID-SEC-2026-3334)
A vulnerability labeled as problematic has been found in PCRE PCRE2 up to 10.47. The affected element is the function pcre2_jit_match of the component JIT Match. The manipulation results in use after free.
This vulnerability is reported as CVE-2026-89161. The attack requires a local approach. No exploit exists.
The affected component should be upgraded.
GHSA
In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context.
ghsa_unreviewed·2026-09-11
CVE-2026-89161 [HIGH] CWE-590 In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context.
In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-89161 mingw-pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match [fedora-all]
bugzilla·2026-09-11·CVSS 7.4
CVE-2026-89161 [HIGH] CVE-2026-89161 mingw-pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match [fedora-all]
CVE-2026-89161 mingw-pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.
Bugzilla
CVE-2026-89161 bootc: PCRE2: Memory corruption vulnerability in pcre2_jit_match [fedora-all]
bugzilla·2026-09-11·CVSS 7.4
CVE-2026-89161 [HIGH] CVE-2026-89161 bootc: PCRE2: Memory corruption vulnerability in pcre2_jit_match [fedora-all]
CVE-2026-89161 bootc: PCRE2: Memory corruption vulnerability in pcre2_jit_match [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.
Bugzilla
CVE-2026-89161 fish: PCRE2: Memory corruption vulnerability in pcre2_jit_match [epel-all]
bugzilla·2026-09-11·CVSS 7.4
CVE-2026-89161 [HIGH] CVE-2026-89161 fish: PCRE2: Memory corruption vulnerability in pcre2_jit_match [epel-all]
CVE-2026-89161 fish: PCRE2: Memory corruption vulnerability in pcre2_jit_match [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.
Bugzilla
CVE-2026-89161 pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match
bugzilla·2026-09-11·CVSS 7.4
CVE-2026-89161 [HIGH] CVE-2026-89161 pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match
CVE-2026-89161 pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match
In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.
Bugzilla
CVE-2026-89161 pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match [fedora-all]
bugzilla·2026-09-11·CVSS 7.4
CVE-2026-89161 [HIGH] CVE-2026-89161 pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match [fedora-all]
CVE-2026-89161 pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.
Bugzilla
CVE-2026-89161 fish: PCRE2: Memory corruption vulnerability in pcre2_jit_match [fedora-all]
bugzilla·2026-09-11·CVSS 7.4
CVE-2026-89161 [HIGH] CVE-2026-89161 fish: PCRE2: Memory corruption vulnerability in pcre2_jit_match [fedora-all]
CVE-2026-89161 fish: PCRE2: Memory corruption vulnerability in pcre2_jit_match [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.
2026-09-11
Published