Log in Start free

Vulnerability · Published Sep 11, 2026 · Assigned by mitre

CVE-2026-89161

High 7.4

In plain English

A high-severity security flaw in PCRE2 from PCRE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.1%top 97.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10mariadb11.83:11.8.8-2.el10_2.alma.2ALSA-2026:84799
AlmaLinux:10mariadb11.8-backup3:11.8.8-2.el10_2.alma.2ALSA-2026:84799
AlmaLinux:10mariadb11.8-client-utils3:11.8.8-2.el10_2.alma.2ALSA-2026:84799
AlmaLinux:10mariadb11.8-common3:11.8.8-2.el10_2.alma.2ALSA-2026:84799
AlmaLinux:10mariadb11.8-devel3:11.8.8-2.el10_2.alma.2ALSA-2026:84799
AlmaLinux:10mariadb11.8-embedded3:11.8.8-2.el10_2.alma.2ALSA-2026:84799
AlmaLinux:10mariadb11.8-embedded-devel3:11.8.8-2.el10_2.alma.2ALSA-2026:84799
AlmaLinux:10mariadb11.8-errmsg3:11.8.8-2.el10_2.alma.2ALSA-2026:84799
AlmaLinux:10mariadb11.8-gssapi-server3:11.8.8-2.el10_2.alma.2ALSA-2026:84799
AlmaLinux:10mariadb11.8-oqgraph-engine3:11.8.8-2.el10_2.alma.2ALSA-2026:84799
AlmaLinux:10mariadb11.8-pam3:11.8.8-2.el10_2.alma.2ALSA-2026:84799
AlmaLinux:10mariadb11.8-server3:11.8.8-2.el10_2.alma.2ALSA-2026:84799
AlmaLinux:10mariadb11.8-server-galera3:11.8.8-2.el10_2.alma.2ALSA-2026:84799
AlmaLinux:10mariadb11.8-server-utils3:11.8.8-2.el10_2.alma.2ALSA-2026:84799
AlmaLinux:10mariadb11.8-test3:11.8.8-2.el10_2.alma.2ALSA-2026:84799
AlmaLinux:10pcre210.44-1.5.el10_2ALSA-2026:81522
AlmaLinux:9pcre210.40-7.el9_8ALSA-2026:81532
AlmaLinux:10pcre2-devel10.44-1.5.el10_2ALSA-2026:81522
AlmaLinux:9pcre2-devel10.40-7.el9_8ALSA-2026:81532
AlmaLinux:10pcre2-static10.44-1.5.el10_2ALSA-2026:81522
AlmaLinux:10pcre2-syntax10.44-1.5.el10_2ALSA-2026:81522
AlmaLinux:9pcre2-syntax10.40-7.el9_8ALSA-2026:81532
AlmaLinux:10pcre2-tools10.44-1.5.el10_2ALSA-2026:81522
AlmaLinux:9pcre2-tools10.40-7.el9_8ALSA-2026:81532
AlmaLinux:10pcre2-utf1610.44-1.5.el10_2ALSA-2026:81522
AlmaLinux:9pcre2-utf1610.40-7.el9_8ALSA-2026:81532
AlmaLinux:10pcre2-utf3210.44-1.5.el10_2ALSA-2026:81522
AlmaLinux:9pcre2-utf3210.40-7.el9_8ALSA-2026:81532
Alpine:v3.21pcre210.43-r1ALPINE-CVE-2026-89161
Alpine:v3.22pcre210.46-r1ALPINE-CVE-2026-89161
Alpine:v3.23pcre210.48-r0ALPINE-CVE-2026-89161
Alpine:v3.24pcre210.48-r0ALPINE-CVE-2026-89161
Debian:12pcre210.42-1+deb12u1DEBIAN-CVE-2026-89161
Debian:13pcre210.46-1~deb13u2DEBIAN-CVE-2026-89161
Debian:14pcre210.48-1DEBIAN-CVE-2026-89161
Rocky Linux:10mariadb11.83:11.8.8-2.el10_2RLSA-2026:84799
Rocky Linux:10pcre20:10.44-1.5.el10_2RLSA-2026:81522
Rocky Linux:9pcre20:10.40-7.el9_8RLSA-2026:81532
Ubuntu:22.04:LTSpcre210.39-3ubuntu0.2USN-8974-1
Ubuntu:22.04:LTSpcre210.39-3ubuntu0.2UBUNTU-CVE-2026-89161
Ubuntu:24.04:LTSpcre210.42-4ubuntu2.2UBUNTU-CVE-2026-89161
Ubuntu:24.04:LTSpcre210.42-4ubuntu2.2USN-8974-1
Ubuntu:26.04:LTSpcre210.46-1ubuntu0.1USN-8974-1
Ubuntu:26.04:LTSpcre210.46-1ubuntu0.1UBUNTU-CVE-2026-89161
Ubuntu:26.10pcre210.46-1ubuntu1UBUNTU-CVE-2026-89161
Ubuntu:26.10pcre210.46-1ubuntu1USN-8974-1

Affected products (as reported)

VendorProductVersions
PCRE PCRE2 0 – before 10.48

Weakness: CWE-590 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References