Search: “PCRE2”

4 stories

PCRE2 10.48 released with security fixes; seven vulnerabilities assigned CVEs including CVE-2026-86145 and CVE-2026-89156 through CVE-2026-89162.

The PCRE2 regular expression library released version 10.48 with multiple security fixes, disclosed on the oss-security mailing list. Seven issues received CVE assignments: CVE-2026-86145, CVE-2026-89156, CVE-2026-89157, CVE-2026-89158, CVE-2026-89160, CVE-2026-89161, and CVE-2026-89162. PCRE2 is a widely used regex engine embedded in many open-source projects and applications. No exploitation is reported in the disclosure.

oss-securitySep 11, 20:19 UTC · 4d agoVulnerability CVE-2026-86145 CVE-2026-89156 CVE-2026-89157+4 CVEs1

Re: pcre2 version 10.48 released with security fixes

PCRE2 10.48 ships security fixes; one issue received CVE-2026-86145 while others await identifiers amid CNA backlogs.

Salvatore Bonaccorso noted on oss-security that PCRE2 version 10.48 includes security fixes, with one issue assigned CVE-2026-86145 and remaining fixes not yet assigned identifiers. The post criticizes large CNA backlogs delaying CVE assignment, which complicates downstream fix tracking. No exploitation is reported.

oss-securitySep 5, 12:14 UTC · 10d agoVulnerability CVE-2026-86145

pcre2 version 10.48 released with security fixes

PCRE2 10.48 released with security fixes; none have CVE IDs assigned yet, details limited to release notes.

The PCRE2 project released version 10.48 including security fixes, announced on the oss-security mailing list. As of publication, none of the fixes had CVE identifiers assigned, and specifics are only available via the project's release notes and security advisories page.

oss-securitySep 4, 23:27 UTC · 11d agoVulnerability

Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days

Microsoft's September 2026 Patch Tuesday fixes a record 966 flaws, including two Windows zero-days actively exploited to gain SYSTEM privileges.

Microsoft's September 2026 Patch Tuesday addresses a record 966 vulnerabilities, including 105 rated Critical, 81 of them remote code execution bugs. Two zero-days were actively exploited: a Windows Update Stack link-following flaw and a Windows ALPC heap-based buffer overflow, both allowing local elevation to SYSTEM privileges. The ALPC flaw was reported by Volexity and Proofpoint researchers, while the Update Stack flaw was credited to Romain Deperne and the Microsoft Threat Intelligence Centre. Microsoft shared no details on how the flaws were exploited in attacks.

BleepingComputerSep 8, 18:18 UTC · 7d agoAdvisory in the wildCVE-2026-69805 CVE-2026-58649 CVE-2026-69806+27 CVEs1