PCRE2 Memory Disclosure in Serialization

Executive Summary

CVE-2026-89162 is a low-severity vulnerability in PCRE2 versions 10.45 and earlier. It involves an uninitialized memory disclosure in the pcre2_serialize_encode() function, where two bytes of uninitialized data from previous memory allocations may be exposed when serializing certain compiled regular expressions. This happens due to uninitialized memory in compiled structures for specific regex patterns and compile options, such as character classes with Unicode code points.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the installed version of PCRE2 on your system. Run: pcre2-config --version or pkg-config --modversion libpcre2-8. If the version is 10.45 or earlier, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

The impact is limited to the disclosure of two random bytes of memory. If serialized data containing these bytes is exposed to untrusted actors, it could potentially leak sensitive information. However, the vulnerability requires local access and has high attack complexity, making exploitation unlikely in most scenarios.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability involves disclosure of two uninitialized memory bytes in PCRE2's pcre2_serialize_encode function, which could potentially expose sensitive data if serialized regex patterns are accessed by untrusted parties. While the impact is limited to two random bytes, it may pose compliance risks under GDPR or HIPAA if such data exposure occurs in systems handling personal or health information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade PCRE2 to version 10.48 or later immediately. For Linux systems, use your package manager (e.g., apt upgrade libpcre2-8-0 or yum update pcre2). For source builds, download and compile the latest version from the official PCRE2 repository.

Useful 0 Not Useful 0