Low severity2.9NVD Advisory· Published Sep 11, 2026· Updated Sep 16, 2026

CVE-2026-89162

Description

In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Pcre/Pcre2references
Pcre/Pcre3 versions
cpe:2.3:a:pcre:pcre2:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:pcre:pcre2:*:*:*:*:*:*:*:*range: >=10.45,<10.48
- cpe:2.3:a:pcre:pcre2:10.48:rc1:*:*:*:*:*:*
- (no CPE)range: <10.48
osv-coords
pkg:rpm/opensuse/pcre2&distro=openSUSE%20Leap%2016.0
Range: < 10.45-160000.4.1

Patches

Vulnerability mechanics

References

github.com/PCRE2Project/pcre2/security/advisories/GHSA-q7rw-r7qq-2hx6nvdExploitVendor Advisory
github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48nvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.189
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000