CVE-2026-86145

PCRE2, the widely embedded Perl-compatible regular expression library, contains an out-of-bounds write in its pcre2_dfa_match function because the code path that reuses a cached workspace block skips the size check that a newly allocated block performs. Triggering the flaw requires either an attacker-controlled regular expression or a recursive pattern combined with a small heap limit set through the API, conditions that arise in applications that let users supply regex patterns or tune PCRE2's heap limit. A successful attacker can write beyond the workspace buffer, corrupting data (high integrity impact per CVSS 3.1) with only low availability impact; code execution is not documented. Any application, service, or language runtime bundling PCRE2 before 10.48 is affected, with real-world exposure concentrated in software that passes user-controlled regexes to the library. No public proof-of-concept or in-the-wild exploitation is known, EPSS puts the 30-day exploitation probability at 0.4%, and the flaw is fixed in PCRE2 10.48.

What to do: Upgrade PCRE2 to 10.48 or later, and install vendor updates (new PHP packages, distribution packages, or application releases) that bundle the fixed library. Audit whether your applications expose user-supplied regular expressions or call pcre2 APIs with recursive patterns and a reduced heap limit, and restrict or validate such inputs until patched. No public PoC or in-the-wild exploitation is known, so no emergency action is required beyond normal patching.