CVE-2026-89161
Received Received - Intake

PCRE2 JIT Match Memory Corruption Vulnerability

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: MITRE

Description
In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89161
EUVD
EUVD-2026-75946

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pcre2project pcre2 to 10.48 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-590 The product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-89161 is a vulnerability in PCRE2 versions before 10.48 where pcre2_jit_match mishandles a previously copied subject passed as a context. This causes an incorrect free operation and a memory leak due to improper handling of the PCRE2_MD_COPIED_SUBJECT flag.

Detection Guidance

To detect this vulnerability, check the installed version of PCRE2 on your system. If you are using a version prior to 10.48, the system is vulnerable. Use commands like 'pcre2-config --version' or 'dpkg -l | grep pcre2' on Linux to verify the installed version.

Impact Analysis

This vulnerability could lead to memory corruption, crashes, or unexpected behavior in applications using PCRE2 with JIT compilation. Attackers might exploit it to cause denial-of-service or execute arbitrary code.

Compliance Impact

This vulnerability involves memory leaks and incorrect free operations in PCRE2's pcre2_jit_match function, which could lead to memory corruption or crashes. Such issues may impact compliance with GDPR or HIPAA by potentially exposing sensitive data through memory leaks or causing system instability that disrupts data processing or storage operations.

Mitigation Strategies

Update PCRE2 to version 10.48 or later to address the memory leak and improper handling in pcre2_jit_match. Review code using pcre2_jit_match with match contexts to ensure PCRE2_MD_COPIED_SUBJECT is handled correctly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89161. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart