CVE-2026-89161

PCRE2, the widely embedded Perl-compatible regular-expression library, contains a memory-management flaw (CWE-590, multiple/incorrect frees of an allocation) in its JIT matching entry point pcre2_jit_match: when a match context carries a previously copied subject, the routine can perform an incorrect free operation on that memory. The bug is only reachable when an application calls pcre2_jit_match with such a copied-subject context, and the CVSS vector (AV:L/AC:H) indicates exploitation requires local or in-process access under specific conditions, making a straightforward remote exploit unlikely. An attacker who can steer a vulnerable application into this call path could corrupt the heap, potentially causing a crash (denial of service) and, per the high confidentiality/integrity/availability ratings, possibly memory disclosure or code execution. Any system running software built with PCRE2 versions before 10.48 that uses the affected JIT call pattern is potentially affected; the flaw is fixed in PCRE2 10.48. There is currently no public proof-of-concept, the issue is not listed in CISA's Known Exploited Vulnerabilities catalog, and no exploitation has been reported in the wild.

What to do: Upgrade PCRE2 to 10.48 or later, or install your operating system or vendor's patched PCRE2 package, and ensure applications that bundle their own copy of the library are rebuilt or updated. Until patched, audit whether your code paths invoke pcre2_jit_match with a match context containing a previously copied subject, since that call pattern is required to reach the bug. With no known proof-of-concept or in-the-wild exploitation, routine patch timelines are reasonable, but monitor the PCRE2 project and downstream packagers for follow-up advisories.