PCRE2 pcre2_match Out-of-Bounds Read in Invalid UTF Matching

Executive Summary

CVE-2026-89160 is an out-of-bounds read vulnerability in PCRE2 versions 10.34 through 10.47. It occurs in the pcre2_match() function when processing invalid UTF-8 subjects with the PCRE2_MATCH_INVALID_UTF flag. The issue arises because backward character scans incorrectly use the start of the entire subject buffer instead of the validated UTF-8 portion, allowing the BACKCHAR macro to read before the allocated buffer if the subject starts with a UTF-8 continuation byte.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the installed PCRE2 version using commands like 'pcre2-config --version' or 'grep pcre2 /usr/include/pcre2.h'. If the version is between 10.34 and 10.47, the system is potentially vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a process crash or potentially disclose adjacent heap memory. Attackers could exploit it to trigger denial-of-service conditions or read sensitive data from memory if they provide specially crafted input to applications using affected PCRE2 versions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling out-of-bounds memory reads, which may lead to unauthorized data disclosure or crashes in applications processing invalid UTF-8 input. Such issues could violate data integrity and confidentiality requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update PCRE2 to version 10.48 or later. If updating is not possible, avoid using the PCRE2_MATCH_INVALID_UTF flag with untrusted input or validate subjects before matching to prevent exploitation.

Useful 0 Not Useful 0