CVE-2026-89162
published 2026-09-11CVE-2026-89162: In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is…
PriorityP412low3.3CVSS 3.1
AVLACLPRLUINSUCLINAN
EPSS
0.16%
4.7th percentile
In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mariadb | mariadb | — | — |
| pcre | pcre2 | — | — |
| pcre | pcre2 | — | — |
| pcre | pcre2 | >= 10.45 < 10.48 | 10.48 |
CVSS provenance
nvdv3.13.3LOWCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
vendor_redhat2.9LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
PCRE PCRE2 up to 10.47 pcre2_serialize_encode information disclosure (WID-SEC-2026-3334)
vuldb·2026-10-24·CVSS 3.3
CVE-2026-89162 [LOW] PCRE PCRE2 up to 10.47 pcre2_serialize_encode information disclosure (WID-SEC-2026-3334)
A vulnerability has been found in PCRE PCRE2 up to 10.47 and classified as problematic. This affects the function pcre2_serialize_encode. This manipulation causes information disclosure.
The identification of this vulnerability is CVE-2026-89162. The attack can only be executed locally. There is no exploit available.
The affected component should be upgraded.
GHSA
In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.
ghsa_unreviewed·2026-09-11
CVE-2026-89162 [LOW] CWE-669 In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.
In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.
Red Hat
pcre2: PCRE2: Information disclosure via pcre2_serialize_encode
vendor_redhat·2026-09-11·CVSS 2.9
CVE-2026-89162 [LOW] CWE-125 pcre2: PCRE2: Information disclosure via pcre2_serialize_encode
pcre2: PCRE2: Information disclosure via pcre2_serialize_encode
A flaw was found in PCRE2. The `pcre2_serialize_encode` function might disclose two bytes of information to an attacker. This vulnerability typically occurs in scenarios where the attacker already has unsafe access to the system, making exploitation difficult. The primary impact is a limited information disclosure.
Statement: This is a information disclosure flaw in PCRE2. The vulnerability, which could expose two bytes of data, requires an adversary to have already gained unsafe access to the system, significantly limiting its exploitability in typical Red Hat deployments.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria compr
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-89162 pcre2: PCRE2: Information disclosure via pcre2_serialize_encode [fedora-all]
bugzilla·2026-09-11·CVSS 2.9
CVE-2026-89162 [LOW] CVE-2026-89162 pcre2: PCRE2: Information disclosure via pcre2_serialize_encode [fedora-all]
CVE-2026-89162 pcre2: PCRE2: Information disclosure via pcre2_serialize_encode [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.
Bugzilla
CVE-2026-89162 mingw-pcre2: PCRE2: Information disclosure via pcre2_serialize_encode [fedora-all]
bugzilla·2026-09-11·CVSS 2.9
CVE-2026-89162 [LOW] CVE-2026-89162 mingw-pcre2: PCRE2: Information disclosure via pcre2_serialize_encode [fedora-all]
CVE-2026-89162 mingw-pcre2: PCRE2: Information disclosure via pcre2_serialize_encode [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.
Bugzilla
CVE-2026-89162 pcre2: PCRE2: Information disclosure via pcre2_serialize_encode
bugzilla·2026-09-11·CVSS 2.9
CVE-2026-89162 [LOW] CVE-2026-89162 pcre2: PCRE2: Information disclosure via pcre2_serialize_encode
CVE-2026-89162 pcre2: PCRE2: Information disclosure via pcre2_serialize_encode
In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.
2026-09-11
Published