# CVE-2026-89160: PCRE2 out-of-bounds read in pcre2_match with invalid UTF

Source: https://junglewise.ai/threats/cve-2026-89160-pcre2-out-of-bounds-read-in-pcre2-match-with-invalid-utf  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-89160 · Severity: low · CVSS 3.7 · Published 2026-09-11

PCRE2 is a widely-used regular expression library used by many applications and services for pattern matching. When processing crafted invalid UTF-8 or UTF-16 input with specific pattern matching options enabled, PCRE2 can read memory before the allocated subject buffer, potentially causing application crashes and disclosure of sensitive heap data.

## Quick answers

**Is CVE-2026-89160 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89160 being exploited in the wild.

**How severe is CVE-2026-89160?** Low severity, with a CVSS score of 3.7, published 11 September 2026.

**Which products and versions are affected?** PCRE2Project PCRE2 10.34 through 10.47.

**Is there a fix for CVE-2026-89160?** A patch was published on 2026-08-31: Fixed in PCRE2 10.48 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-89160 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-89160?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is an out-of-bounds heap read (CWE-125) in the pcre2_match() interpreter occurring during backward character scans when PCRE2_MATCH_INVALID_UTF is enabled. The root cause is that certain code paths (variable-length lookbehind and extended-grapheme \X operations) use start_subject as their lower bound instead of check_subject, which marks the beginning of validated UTF content. When a subject begins with a UTF-8 continuation byte (0x80–0xBF) or UTF-16 low surrogate, the unbounded BACKCHAR macro can step past the buffer start. Exploitation requires the application to compile patterns with PCRE2_UTF and PCRE2_MATCH_INVALID_UTF, then match untrusted subjects. The 8-bit and 16-bit code paths are affected; 32-bit is unaffected. Impact is limited to process crash or information disclosure from adjacent heap memory; remote code execution is not demonstrated. Fixed in PCRE2 10.48 by applying check_subject bounds to affected backward-walk operations.

## Affected products

- PCRE2Project PCRE2 10.34 through 10.47

## Timeline

- 2026-08-31: disclosed
- 2026-08-31: patched: Fixed in PCRE2 10.48

## References

- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)
- [https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-9qww-pwc4-77qq](https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-9qww-pwc4-77qq)