JIT buffer overflow fixed in libpcre2-10.49
PCRE2 10.49 fixes a JIT out-of-bounds write that needs an attacker-controlled regular expression.
48
Vendor
PCRE2 Project
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenSep 4, 2026
- Last mentionedSep 29, 2026
Timeline
3 articles · newest firstRe: pcre2 version 10.48 released with security fixes
PCRE2 10.48 released with security fixes; seven vulnerabilities assigned CVEs including CVE-2026-86145 and CVE-2026-89156 through CVE-2026-89162.
45
pcre2 version 10.48 released with security fixes
PCRE2 10.48 released with security fixes; none have CVE IDs assigned yet, details limited to release notes.
20
Related CVEs
by mentions- CVE-2026-86145<1%8.2Out-of-Bounds Write in PCRE2 Regular Expression Library (pcre2_dfa_match)
- Incorrect free (double free) in PCRE2 JIT matching before 10.48
- CVE-2026-89157<1%7.4Out-of-Bounds Write in PCRE2 32-Bit Builds via Attacker-Supplied Large Patterns
- CVE-2026-89160<1%6.5Out-of-Bounds Read in PCRE2 pcre2_match on Invalid UTF Subjects
- Out-of-Bounds Write via Integer Overflow in PCRE2 on 32-bit Platforms
- CVE-2026-89156<1%5.9Out-of-Bounds Read in PCRE2 pcre2_match via JIT Fallback on Invalid UTF Data
- CVE-2026-89162<1%3.3Two-byte information disclosure in PCRE2 pcre2_serialize_encode before 10.48
Appears with
- PCRE2product · 3
- PCRE2 Projectorganization · 2
- oss-securityorganization · 1
- libpcre2product · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.