Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-09-11T04:09:06 pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CWE-125

PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.

A flaw was found in PCRE2, a library for processing regular expressions. A remote attacker could exploit this vulnerability by providing a specially crafted input that triggers an out-of-bounds read during pattern matching with invalid UTF (Unicode Transformation Format) characters. This could lead to a denial of service, making the affected system or application unavailable.

This flaw is rated as Low impact. A denial of service could occur in applications utilizing PCRE2 for regular expression matching if specially crafted invalid UTF input is processed. The high attack complexity required to trigger this out-of-bounds read limits its overall impact on Red Hat products. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Hardened Images 2026-09-15T00:00:00Z RHSA-2026:67534 pcre2-main-10.48-0.1.hum1 Red Hat Enterprise Linux 10 Not affected bootc Red Hat Enterprise Linux 10 Fix deferred mariadb10.11 Red Hat Enterprise Linux 10 Fix deferred mariadb11.8 Red Hat Enterprise Linux 10 Fix deferred mingw-pcre2 Red Hat Enterprise Linux 10 Affected pcre2 Red Hat Enterprise Linux 7 Not affected pcre2 Red Hat Enterprise Linux 8 Fix deferred mariadb:10.11/mariadb Red Hat Enterprise Linux 8 Not affected pcre2 Red Hat Enterprise Linux 9 Not affected bootc Red Hat Enterprise Linux 9 Fix deferred mariadb:10.11/mariadb Red Hat Enterprise Linux 9 Fix deferred mariadb:11.8/mariadb Red Hat Enterprise Linux 9 Fix deferred mingw-pcre2 Red Hat Enterprise Linux 9 Affected pcre2 Red Hat Hardened Images Not affected rust Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Fix deferred openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-89160 https://nvd.nist.gov/vuln/detail/CVE-2026-89160 https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48 https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-9qww-pwc4-77qq