# CVE-2026-86145: PCRE2 out-of-bounds write in DFA matching with recursive patterns

Source: https://junglewise.ai/threats/cve-2026-86145-pcre2-out-of-bounds-write-in-dfa-matching-with-recursive-patterns  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-05. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86145 · Severity: high · CVSS 8.2 · Published 2026-09-05

PCRE2 is a widely-used regular expression library embedded in many applications and system utilities. A flaw in its DFA (deterministic finite automaton) matching engine allows an attacker who can control a regular expression pattern to trigger a heap buffer overflow, potentially crashing the application or enabling code execution. This vulnerability requires the application to use the pcre2_dfa_match() function with untrusted patterns or a recursive pattern combined with a low heap limit.

## Quick answers

**Is CVE-2026-86145 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86145 being exploited in the wild.

**How severe is CVE-2026-86145?** High severity, with a CVSS score of 8.2, published 5 September 2026.

**Which products and versions are affected?** PCRE2Project PCRE2 10.32 through 10.47.

**Is there a fix for CVE-2026-86145?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-86145 attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected by CVE-2026-86145?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a heap buffer overflow (CWE-122) in PCRE2's DFA matching workspace management. The more_workspace() function in pcre2_dfa_match.c reuses a cached workspace block without checking whether it is large enough for the new request, even though freshly-allocated blocks are subject to a size check. An attacker can craft a regular expression using nested assertions and recursion, optionally combined with a (*LIMIT_HEAP=...) pattern control verb, to force allocation of a small workspace block followed by a request for a larger block. The cached smaller block is then reused, and subsequent writes to the workspace exceed the allocation bounds. The attack vector is network/local (requires attacker-controlled regex), and affects PCRE2 versions 10.32 through 10.47. The fix (version 10.48) adds bounds checks before reusing cached blocks and hardens integer-overflow calculations.

## Affected products

- PCRE2Project PCRE2 10.32 through 10.47

## Timeline

- 2026-08-31: disclosed: PCRE2 10.48 released with fix
- 2026-09-05: advisory: CVE-2026-86145 published

## References

- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)
- [https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf](https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf)