PatchTheCVEpcre2 vulnerabilities and fixes
Recent CVEs affecting pcre2, with upgrade or downgrade steps. 6 tracked.
pcre2 has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 6. Most recent: 2026-09-11. Highest priority: CVE-2026-89157 (score 32/100).
- CVE-2026-89156 LOW 2.9 UPGRADE PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide inva
- CVE-2026-89157 MEDIUM 5.7 UPGRADE PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can
- CVE-2026-89158 MEDIUM 6.5 UPGRADE PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds w
- CVE-2026-89160 LOW 3.7 UPGRADE PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an inva
- CVE-2026-89161 HIGH 7.4 UPGRADE In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context
- CVE-2026-89162 LOW 2.9 UPGRADE In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situati
FAQ
How do I fix pcre2 vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is pcre2 being exploited right now?
None of the tracked pcre2 CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which pcre2 CVE should I patch first?
CVE-2026-89157 currently ranks highest (32/100): PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can .