Quick answers
- Is CVE-2026-103111 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-103111 being exploited in the wild.
- How severe is CVE-2026-103111?
- High severity, with a CVSS score of 7.6, published 30 September 2026.
- Which products and versions are affected?
- PCRE2Project PCRE2 before 10.49.
- Is there a fix for CVE-2026-103111?
- A patch was published on 2026-09-30: Version 10.49 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-103111 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-103111?
- Check whether you run PCRE2Project PCRE2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An out-of-bounds write occurs in PCRE2's JIT stack management when a single stack allocation exceeds the fixed growth increment (8192 bytes). The JIT stack resize stub did not properly validate that adjusted stack pointers remained within bounds before allowing writes. An attacker must supply an attacker-controlled regex (requiring large capturing groups or recursion) that is JIT-compiled and matched by an application using pcre2_jit_stack_create() and pcre2_jit_stack_assign(). The fix, released in PCRE2 10.49, validates the resize target against the maximum stack extent and fails the match operation if the required allocation would exceed bounds.
Affected products
- PCRE2Project PCRE2 before 10.49
Timeline
- 2026-09-28: disclosed
- 2026-09-30: patched: Version 10.49 released