Is CVE-2026-86145 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86145 being exploited in the wild.

How severe is CVE-2026-86145?

High severity, with a CVSS score of 8.2, published 5 September 2026.

Which products and versions are affected?

PCRE2Project PCRE2 10.32 through 10.47.

Is there a fix for CVE-2026-86145?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86145 attacked?

It is attacked over the network or with local access, in a software library.

Am I affected by CVE-2026-86145?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86145: PCRE2 out-of-bounds write in DFA matching with recursive patterns

CVE-2026-86145 · Severity: high · CVSS 8.2 · Published 2026-09-05

PCRE2 is a widely-used regular expression library embedded in many applications and system utilities. A flaw in its DFA (deterministic finite automaton) matching engine allows an attacker who can control a regular expression pattern to trigger a heap buffer overflow, potentially crashing the application or enabling code execution. This vulnerability requires the application to use the pcre2_dfa_match() function with untrusted patterns or a recursive pattern combined with a low heap limit.

Quick answers

Is CVE-2026-86145 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86145 being exploited in the wild.
How severe is CVE-2026-86145?: High severity, with a CVSS score of 8.2, published 5 September 2026.
Which products and versions are affected?: PCRE2Project PCRE2 10.32 through 10.47.
Is there a fix for CVE-2026-86145?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86145 attacked?: It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-86145?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a heap buffer overflow (CWE-122) in PCRE2's DFA matching workspace management. The more_workspace() function in pcre2_dfa_match.c reuses a cached workspace block without checking whether it is large enough for the new request, even though freshly-allocated blocks are subject to a size check. An attacker can craft a regular expression using nested assertions and recursion, optionally combined with a (*LIMIT_HEAP=...) pattern control verb, to force allocation of a small workspace block followed by a request for a larger block. The cached smaller block is then reused, and subsequent writes to the workspace exceed the allocation bounds. The attack vector is network/local (requires attacker-controlled regex), and affects PCRE2 versions 10.32 through 10.47. The fix (version 10.48) adds bounds checks before reusing cached blocks and hardens integer-overflow calculations.

Affected products

PCRE2Project PCRE2 10.32 through 10.47

Timeline

2026-08-31: disclosed: PCRE2 10.48 released with fix
2026-09-05: advisory: CVE-2026-86145 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.