CVE-2026-86145
Received Received - Intake

Out-of-Bounds Write in PCRE2 Library

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: MITRE

Description
PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-86145
EUVD
EUVD-2026-71836

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pcre2project pcre2 From 10.32 (inc) to 10.48 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-424 The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86145 is a heap-based buffer overflow in PCRE2 versions 10.32 through 10.47. It occurs in the pcre2_dfa_match() function when handling recursive patterns with a low heap limit. An attacker can exploit this by providing a specially crafted regular expression containing nested assertions and recursion, causing out-of-bounds writes during DFA state data processing.

Detection Guidance

Detecting this vulnerability requires checking the installed PCRE2 version and monitoring for crashes or memory corruption when processing untrusted regular expressions. Use 'pcre2-config --version' to check the version. If using version 10.32 to 10.47, the system is vulnerable. Monitor application logs for segmentation faults or heap corruption errors during regex processing.

Impact Analysis

This vulnerability can lead to process crashes (denial of service) or memory corruption with heap grooming. It requires only attacker-controlled regular expressions and may allow further exploitation depending on the application context.

Mitigation Strategies

Upgrade PCRE2 to version 10.48 or later immediately. If upgrading is not possible, avoid using pcre2_dfa_match() with untrusted regular expressions. Configure applications to reject or sanitize user-provided regex patterns. Apply any available vendor patches for PCRE2 or dependent software.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86145. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart