CVE-2026-86145: Pcre PCRE2

High severity, CVSS 8.2. EPSS: 0.4% chance of exploitation in the next 30 days.

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).

Affected products

• Pcre PCRE2: from 10.32, before 10.48 (fixed in 10.48)

Published 2026-09-05. Last modified 2026-09-09.