# CVE-2026-89158: PCRE2 integer overflow in pcre2_compile_32 on 32-bit systems

Source: https://junglewise.ai/threats/cve-2026-89158-pcre2-integer-overflow-in-pcre2-compile-32-on-32-bit-systems  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-89158 · Severity: medium · CVSS 6.5 · Published 2026-09-11

PCRE2 is a widely-used regular expression pattern-matching library embedded in many applications and systems. On 32-bit platforms, a flaw in the 32-bit code-unit variant of the library allows an attacker who can provide untrusted regex patterns to trigger a buffer overflow during pattern compilation, potentially enabling code execution or system compromise.

## Quick answers

**Is CVE-2026-89158 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89158 being exploited in the wild.

**How severe is CVE-2026-89158?** Medium severity, with a CVSS score of 6.5, published 11 September 2026.

**Which products and versions are affected?** PCRE2Project PCRE2 before 10.48.

**Is there a fix for CVE-2026-89158?** A patch was published on 2026-08-31: Fixed in PCRE2 10.48 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-89158 attacked?** It is attacked over the network or with local access.

**Am I affected by CVE-2026-89158?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an integer overflow in the pcre2_compile_32() function on 32-bit systems. When compiling a pattern whose compiled form requires exactly 2^30 code units, the CU2BYTES() macro wraps around, causing undersized heap buffer allocation. The attacker-controlled pattern is then compiled into the undersized buffer, resulting in an out-of-bounds heap write. The flaw only affects the 32-bit code-unit API (pcre2_compile_32) on 32-bit platforms; the 8-bit and 16-bit variants are not affected. No authentication or network access is required—only the ability to supply a crafted regex pattern to an application that uses PCRE2's 32-bit library in a 32-bit process. The vulnerability was patched in PCRE2 version 10.48 by adding bounds checks and hardening integer arithmetic in the compilation path.

## Affected products

- PCRE2Project PCRE2 before 10.48

## Timeline

- 2026-08-31: disclosed
- 2026-08-31: patched: Fixed in PCRE2 10.48

## References

- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)
- [https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-fmgr-6ggq-9859](https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-fmgr-6ggq-9859)