Out-of-bounds read in PCRE2 - CVE-2026-89160

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in pcre2_match() interpreter when processing invalid UTF subjects with PCRE2_MATCH_INVALID_UTF during backward character scans. A remote attacker can supply a specially crafted subject string to cause a denial of service.

Only patterns compiled with PCRE2_UTF and PCRE2_MATCH_INVALID_UTF are affected, and exploitation requires an invalid subject beginning with a UTF continuation code unit together with affected backward-walking pattern operations such as \X or variable-length lookbehind.

Affected software

How to mitigate CVE-2026-89160

External References

• https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-9qww-pwc4-77qq

Related Security Bulletins

• Multiple vulnerabilities in PCRE2
• Anolis OS update for pcre2