Is CVE-2026-89160 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89160 being exploited in the wild.

How severe is CVE-2026-89160?

Low severity, with a CVSS score of 3.7, published 11 September 2026.

Which products and versions are affected?

PCRE2Project PCRE2 10.34 through 10.47.

Is there a fix for CVE-2026-89160?

A patch was published on 2026-08-31: Fixed in PCRE2 10.48 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-89160 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-89160?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89160: PCRE2 out-of-bounds read in pcre2_match with invalid UTF

CVE-2026-89160 · Severity: low · CVSS 3.7 · Published 2026-09-11

PCRE2 is a widely-used regular expression library used by many applications and services for pattern matching. When processing crafted invalid UTF-8 or UTF-16 input with specific pattern matching options enabled, PCRE2 can read memory before the allocated subject buffer, potentially causing application crashes and disclosure of sensitive heap data.

Quick answers

Is CVE-2026-89160 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89160 being exploited in the wild.
How severe is CVE-2026-89160?: Low severity, with a CVSS score of 3.7, published 11 September 2026.
Which products and versions are affected?: PCRE2Project PCRE2 10.34 through 10.47.
Is there a fix for CVE-2026-89160?: A patch was published on 2026-08-31: Fixed in PCRE2 10.48 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89160 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-89160?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is an out-of-bounds heap read (CWE-125) in the pcre2_match() interpreter occurring during backward character scans when PCRE2_MATCH_INVALID_UTF is enabled. The root cause is that certain code paths (variable-length lookbehind and extended-grapheme \X operations) use start_subject as their lower bound instead of check_subject, which marks the beginning of validated UTF content. When a subject begins with a UTF-8 continuation byte (0x80–0xBF) or UTF-16 low surrogate, the unbounded BACKCHAR macro can step past the buffer start. Exploitation requires the application to compile patterns with PCRE2_UTF and PCRE2_MATCH_INVALID_UTF, then match untrusted subjects. The 8-bit and 16-bit code paths are affected; 32-bit is unaffected. Impact is limited to process crash or information disclosure from adjacent heap memory; remote code execution is not demonstrated. Fixed in PCRE2 10.48 by applying check_subject bounds to affected backward-walk operations.

Affected products

PCRE2Project PCRE2 10.34 through 10.47

Timeline

2026-08-31: disclosed
2026-08-31: patched: Fixed in PCRE2 10.48

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.