CVE-2026-89158

PCRE2, the widely embedded open-source regular-expression library, contains an integer overflow (CWE-190) in its pcre2_compile_32 function on 32-bit platforms, which can result in an out-of-bounds write. It is triggered when an application running a vulnerable PCRE2 build (before 10.48) on a 32-bit platform compiles a crafted regular expression meeting the specific memory-size conditions implied by the high attack complexity score. An attacker who can get such a pattern compiled gains memory corruption with high integrity impact and low availability impact per the CVSS score, meaning tampering or possible crashes rather than data disclosure. Anyone deploying PCRE2 before 10.48 on 32-bit builds is affected, including downstream distributions, language runtimes and appliances that bundle the library; 64-bit deployments are not described as affected. There is no public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation is known; the fix shipped with the PCRE2 10.48 release.

What to do: Upgrade PCRE2 to 10.48 or later, or install a vendor/distribution package that backports the fix, and rebuild any statically linked or bundled copies. As mitigation, restrict or validate untrusted regular expressions compiled by 32-bit builds. Inventory 32-bit (i386 / 32-bit ARM) deployments and applications that expose regex compilation to untrusted input, since those are the only ones affected.