CVE-2026-86145

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-05 · updated 2026-09-09
Weakness: CWE-424

Description

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).

Affected products

PCRE2: from 10.32 before 10.48 — fixed in 10.48

How to fix

Upgrade to a fixed version: PCRE2 10.48. Check the vendor advisory for mitigations.

References

https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48
https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf
http://www.openwall.com/lists/oss-security/2026/09/05/3

Get alerted when CVE-2026-86145 or the next vulnerability affects your stack