High severity8.2NVD Advisory· Published Sep 5, 2026· Updated Sep 9, 2026
CVE-2026-86145
CVE-2026-86145
Description
PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
9- osv-coords8 versionspkg:rpm/almalinux/pcre2pkg:rpm/almalinux/pcre2-develpkg:rpm/almalinux/pcre2-utf32pkg:rpm/opensuse/pcre2&distro=openSUSE%20Leap%2016.0pkg:rpm/almalinux/pcre2-syntaxpkg:rpm/almalinux/pcre2-toolspkg:rpm/almalinux/pcre2-utf16pkg:rpm/almalinux/pcre2-static
< 10.44-1.5.el10_2+ 7 more
- (no CPE)range: < 10.44-1.5.el10_2
- (no CPE)range: < 10.44-1.5.el10_2
- (no CPE)range: < 10.44-1.5.el10_2
- (no CPE)range: < 10.45-160000.4.1
- (no CPE)range: < 10.44-1.5.el10_2
- (no CPE)range: < 10.44-1.5.el10_2
- (no CPE)range: < 10.44-1.5.el10_2
- (no CPE)range: < 10.44-1.5.el10_2
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.