CVE-2026-89157

PCRE2 before 10.48 contains an integer-overflow flaw (CWE-190) in the pcre2_pattern_convert function that leads to an out-of-bounds write, but only on 32-bit platforms and only when an attacker can supply a sufficiently large pattern. An application or service that compiles untrusted patterns on a 32-bit build is therefore exposed: successful corruption can modify memory outside the intended buffer, with the CVSS vector indicating high integrity impact and low availability impact but no confidentiality impact. Affected users are any products or deployments that ship or link a 32-bit build of PCRE2 older than 10.48 and pass attacker-controlled pattern data to the library; 64-bit deployments are not affected by this issue. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and there are no confirmed reports of exploitation in the wild.

What to do: Upgrade PCRE2 to version 10.48 or later, and rebuild or redeploy any application that statically or dynamically bundles an older 32-bit PCRE2 (check dependencies such as PHP, Exim, PostgreSQL or other software that embeds PCRE2 rather than relying on the system copy). Until patched, restrict or reject large attacker-supplied patterns on 32-bit builds to prevent the overflow condition. 64-bit deployments do not need immediate action for this flaw.