Out-of-Bounds Write Vulnerability in PCRE2 Library by PCRE2 Project

CVE-2026-86145

What is CVE-2026-86145?

The PCRE2 library prior to version 10.48 is vulnerable to an out-of-bounds write when utilizing the pcre2_dfa_match function. This occurs due to the improper handling of cached workspace blocks during recursive DFA matching, leading to potential exploitation through an attacker-controlled regular expression. To successfully exploit this vulnerability, an attacker must leverage a recursive pattern in combination with a constrained heap limit, which can be specified through the API. Proper size checks are missing for reused cached blocks, creating a security risk that can compromise the integrity of applications utilizing it.

References