Vulnerability Description
PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48
- https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf
- http://www.openwall.com/lists/oss-security/2026/09/05/3
FAQ
What is CVE-2026-86145?
CVE-2026-86145 is a vulnerability with a CVSS score of 8.2 (HIGH). PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated bloc...
How severe is CVE-2026-86145?
CVE-2026-86145 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-86145?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.