Integer overflow in PCRE2 - CVE-2026-89157

Vulnerability details

The vulnerability allows a remote attacker to cause memory corruption and a process crash.

The vulnerability exists due to integer overflow leading to an out-of-bounds write in pcre2_pattern_convert() when processing a very large attacker-controlled pattern using PCRE2-managed output allocation on a 32-bit system. A remote attacker can supply a specially crafted large foreign-syntax pattern to cause memory corruption and a process crash.

The issue occurs before pattern compilation or matching, and requires a 32-bit process with a non-NULL buffptr whose value is NULL.

Affected software

How to mitigate CVE-2026-89157

External References

• https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9
• https://github.com/PCRE2Project/pcre2/commit/8156b3989a82f2ddf9504d8248496e9b124be7f3

Related Security Bulletins

• Multiple vulnerabilities in PCRE2
• Anolis OS update for pcre2