Is CVE-2026-89157 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89157 being exploited in the wild.

How severe is CVE-2026-89157?

Medium severity, with a CVSS score of 5.7, published 11 September 2026.

Which products and versions are affected?

PCRE2Project PCRE2 10.30 through 10.47.

Is there a fix for CVE-2026-89157?

A patch was published on 2026-08-31: Fixed in version 10.48 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-89157 attacked?

It is attacked over the network.

Am I affected by CVE-2026-89157?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89157: PCRE2 out-of-bounds write in pcre2_pattern_convert on 32-bit platforms

CVE-2026-89157 · Severity: medium · CVSS 5.7 · Published 2026-09-11

PCRE2 is a widely-used regular expression library integrated into many applications and systems. When processing very large patterns through the pattern conversion API on 32-bit systems, PCRE2 can allocate an undersized buffer and write beyond its bounds, causing crashes or potential memory corruption. This affects applications that accept untrusted regex patterns for conversion.

Quick answers

Is CVE-2026-89157 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89157 being exploited in the wild.
How severe is CVE-2026-89157?: Medium severity, with a CVSS score of 5.7, published 11 September 2026.
Which products and versions are affected?: PCRE2Project PCRE2 10.30 through 10.47.
Is there a fix for CVE-2026-89157?: A patch was published on 2026-08-31: Fixed in version 10.48 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89157 attacked?: It is attacked over the network.
Am I affected by CVE-2026-89157?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A 32-bit integer overflow vulnerability exists in the pcre2_pattern_convert() function's automatic output allocation path. The vulnerability occurs when PCRE2-managed output allocation is requested (non-NULL buffptr with *buffptr == NULL) on 32-bit platforms. The affected code multiplies the converted pattern length by PCRE2_CODE_UNIT_WIDTH (a bit width, not a byte count), causing the multiplication to overflow and result in allocation of only the internal header (~12 bytes) while the function then writes a much larger converted pattern beyond the allocated buffer. The vulnerability requires an attacker to supply a very large foreign-syntax pattern to be converted; pattern compilation and matching are not involved. Fixed in PCRE2 10.48 via proper byte-size calculation and allocation overflow checks.

Affected products

PCRE2Project PCRE2 10.30 through 10.47

Timeline

2026-08-31: disclosed
2026-08-31: patched: Fixed in version 10.48

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.