CVE-2026-89156

PCRE2, the widely used Perl-compatible regular expression library, contains an out-of-bounds read (CWE-125) in pcre2_match that occurs when the JIT-compiled matcher falls back to the interpreter path and the caller supplies invalid UTF data. An attacker who can feed malformed UTF input into a matching operation can trigger a read past the end of the subject buffer, with the practical impact being a crash or limited availability loss, consistent with the low CVSS 3.1 score of 2.9 (local vector, high complexity). Because PCRE2 ships as a system library on virtually every Linux distribution and is embedded or linked into countless applications such as PHP and Git, any consumer that processes untrusted UTF input with pcre2_match and JIT enabled is potentially affected. The flaw is fixed in PCRE2 10.48. No public proof-of-concept is known, the issue is not in CISA KEV, and no exploitation has been reported in the wild.

What to do: Upgrade PCRE2 to version 10.48 or later, or install distribution-provided patched libpcre2 packages, and restart or rebuild dependent applications (e.g., PHP builds) so they pick up the fixed library. Check the installed version with 'pcre2-config --version' or your package manager, and as an interim mitigation consider disabling JIT or validating/normalizing UTF-8 input before running matches on untrusted data.