CVE-2026-89162

PCRE2 before 10.48 contains an information-disclosure flaw in pcre2_serialize_encode, the API used to serialize compiled regular-expression patterns for storage or transfer between processes. When the function runs, it may disclose two bytes of memory to an adversary; the CVSS 2.9 score reflects a local attack vector with high attack complexity and only a low confidentiality impact (no integrity or availability effect). An attacker gains at most two bytes of memory contents, and the advisory itself notes the leak typically matters only in situations where the adversary already has an unsafe level of access to the application. PCRE2 is an extremely widely bundled regex library (shipped in PHP, nearly every Linux distribution, and countless applications), but only software that actually invokes the rarely used serialize/encode API can expose the leak. No public proof of concept is known, the issue is not in CISA's KEV, and no exploitation has been reported; the flaw is fixed in PCRE2 10.48.

What to do: Upgrade PCRE2 to version 10.48 or later, or install the patched library package once your Linux distribution or PHP vendor ships it. Most deployments are not realistically affected because few applications call the serialize API; audit your software (or vendored copies of PCRE2) for use of pcre2_serialize_encode/pcre2_serialize_decode to determine whether the flaw is actually reachable in your environment.