CVE-2026-89162

In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.

In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.

In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.

This update for pcre2 fixes the following issues:

• CVE-2026-86145: missing size checks in pcre2_dfa_match code can lead to an out-of-bounds write (bsc#1279893).
• CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback (bsc#1280054).
• CVE-2026-89157: out-of-bounds write via large pattern input (bsc#1280053).
• CVE-2026-89158: out-of-bounds write due to integer overflow in pcre2_compile_32 for 32-bit platforms (bsc#1280052).
• CVE-2026-89160: out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject (bsc#1280051).
• CVE-2026-89161: incorrect free operation due to mishandling of a previously copied subject in pcre2_jit_match (bsc#1280050).
• CVE-2026-89162: information disclosure via pcre2_serialize_encode (bsc#1280049).

This update for pcre2 fixes the following issues:

• CVE-2026-86145: missing size checks in pcre2_dfa_match code can lead to an out-of-bounds write (bsc#1279893).
• CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback (bsc#1280054).
• CVE-2026-89157: out-of-bounds write via large pattern input (bsc#1280053).
• CVE-2026-89158: out-of-bounds write due to integer overflow in pcre2_compile_32 for 32-bit platforms (bsc#1280052).
• CVE-2026-89160: out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject (bsc#1280051).
• CVE-2026-89161: incorrect free operation due to mishandling of a previously copied subject in pcre2_jit_match (bsc#1280050).
• CVE-2026-89162: information disclosure via pcre2_serialize_encode (bsc#1280049).

This update for pcre2 fixes the following issues:

• CVE-2026-86145: missing size checks in pcre2_dfa_match code can lead to an out-of-bounds write (bsc#1279893).
• CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback (bsc#1280054).
• CVE-2026-89157: out-of-bounds write via large pattern input (bsc#1280053).
• CVE-2026-89158: out-of-bounds write due to integer overflow in pcre2_compile_32 for 32-bit platforms (bsc#1280052).
• CVE-2026-89160: out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject (bsc#1280051).
• CVE-2026-89161: incorrect free operation due to mishandling of a previously copied subject in pcre2_jit_match (bsc#1280050).
• CVE-2026-89162: information disclosure via pcre2_serialize_encode (bsc#1280049).

It was discovered that PCRE2 did not correctly manage memory when processing certain patterns. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-86145)

Albert Zhang discovered that PCRE2 did not correctly process certain input. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-89156)

It was discovered that PCRE2 did not correctly handle large patterns. On 32-bit platforms, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-89157)

It was discovered that PCRE2 did not correctly handle certain patterns. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-89158)

Ilia Alshanetsky discovered that PCRE2 did not correctly handle certain input. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-89160)

It was discovered that PCRE2 did not correctly manage memory when handling certain patterns. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-89161)

It was discovered that PCRE2 could expose uninitialized data in certain circumstances. A local attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-89162)

Michael Allen discovered that PCRE2 did not correctly manage memory when using just-in-time compilation. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-103111)