CVE-2026-86145: CWE-424 Improper Protection of Alternate Path in PCRE PCRE2

PCRE2 before version 10.48 contains a vulnerability (CWE-424) where the reuse of a cached workspace block in the recursive DFA matching workspace lacks a size check, unlike newly allocated blocks which have this check. This flaw can lead to an out-of-bounds write in the pcre2_dfa_match function. Successful exploitation requires an attacker to supply a crafted regular expression or recursive pattern and manipulate the heap limit through the API to trigger the condition.

The vulnerability allows an attacker to cause an out-of-bounds write, which can lead to arbitrary code execution or application instability. The CVSS score of 8.2 reflects a high impact on integrity with limited impact on availability and no impact on confidentiality. The attack vector is network-based with low attack complexity and no required privileges or user interaction.

No explicit patch or remediation details are provided in the vendor advisory or patch links. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing attacker-controlled recursive regular expressions with small heap limits in affected PCRE2 versions.