Is CVE-2026-89156 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89156 being exploited in the wild.

How severe is CVE-2026-89156?

Low severity, with a CVSS score of 2.9, published 11 September 2026.

Which products and versions are affected?

PCRE2Project PCRE2 before 10.48.

Is there a fix for CVE-2026-89156?

A patch was published on 2026-08-31: Fixed in PCRE2 10.48 release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-89156 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-89156?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89156: PCRE2 out-of-bounds read in pcre2_match after JIT fallback

CVE-2026-89156 · Severity: low · CVSS 2.9 · Published 2026-09-11

PCRE2 is a regular expression matching library used in many applications and systems. When an application processes untrusted input with specific JIT and pattern options, a malformed UTF sequence can cause the library to read beyond the input buffer and crash with a denial-of-service error. This affects any service or application that performs pattern matching on untrusted data.

Quick answers

Is CVE-2026-89156 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89156 being exploited in the wild.
How severe is CVE-2026-89156?: Low severity, with a CVSS score of 2.9, published 11 September 2026.
Which products and versions are affected?: PCRE2Project PCRE2 before 10.48.
Is there a fix for CVE-2026-89156?: A patch was published on 2026-08-31: Fixed in PCRE2 10.48 release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89156 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-89156?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an out-of-bounds read in the pcre2_match() function that occurs when JIT compilation is configured for a different matching mode than the one used in the actual match call, causing fallback to the interpreter. The 8-bit PCRE2 library skips UTF validation in the interpreter because JIT already performed a check, but the JIT validation scope is smaller than the interpreter's lookbehind boundary. When processing invalid UTF sequences with unicode word-boundary operations (OP_UCP_WORD_BOUNDARY), unchecked data beyond the subject buffer is read and used as an unbounded index into the Unicode character database, causing a deterministic segmentation fault. Exploitation requires: the application uses pcre2_match() with PCRE2_UTF flag, a non-zero starting offset, a pattern containing lookbehind, and JIT compiled for a different matching mode than used in the call. The fix in PCRE2 10.48 adds a check ensuring JIT supports the requested matching mode before entering JIT validation, otherwise falling back to the interpreter with proper UTF validation.

Affected products

PCRE2Project PCRE2 before 10.48

Timeline

2026-08-31: disclosed
2026-08-31: patched: Fixed in PCRE2 10.48 release

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.