CVE-2026-89157: CWE-190 Integer Overflow or Wraparound in PCRE PCRE2
CVE-2026-89157 is an integer overflow or wraparound vulnerability in PCRE2 versions 10.30 up to but not including 10.48 on 32-bit platforms. It occurs in the pcre2_pattern_convert function when processing a large pattern, leading to an out-of-bounds write. This vulnerability can cause integrity and availability impacts but does not affect confidentiality.
AI Analysis
Technical Summary
PCRE2 before version 10.48 on 32-bit platforms contains a vulnerability (CWE-190) where the pcre2_pattern_convert function performs an out-of-bounds write due to an integer overflow or wraparound when handling large patterns. This flaw can be triggered by an attacker supplying a specially crafted large pattern, potentially leading to memory corruption that affects the integrity and availability of the affected system.
Potential Impact
The vulnerability does not impact confidentiality but can compromise the integrity and availability of the system by causing out-of-bounds memory writes. This could lead to application crashes or unpredictable behavior, potentially disrupting services that rely on PCRE2 pattern processing.
Mitigation Recommendations
No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance before deploying any fixes. Until a patch is available, avoid processing untrusted large patterns on affected versions.
CVE-2026-89157: CWE-190 Integer Overflow or Wraparound in PCRE PCRE2
Description
CVE-2026-89157 is an integer overflow or wraparound vulnerability in PCRE2 versions 10.30 up to but not including 10.48 on 32-bit platforms. It occurs in the pcre2_pattern_convert function when processing a large pattern, leading to an out-of-bounds write. This vulnerability can cause integrity and availability impacts but does not affect confidentiality.
CVSS v3.1
Score 5.7medium
Affected software
PCRE
PCRE2
pkg:github/pcre2project/pcre2Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
PCRE2 before version 10.48 on 32-bit platforms contains a vulnerability (CWE-190) where the pcre2_pattern_convert function performs an out-of-bounds write due to an integer overflow or wraparound when handling large patterns. This flaw can be triggered by an attacker supplying a specially crafted large pattern, potentially leading to memory corruption that affects the integrity and availability of the affected system.
Potential Impact
The vulnerability does not impact confidentiality but can compromise the integrity and availability of the system by causing out-of-bounds memory writes. This could lead to application crashes or unpredictable behavior, potentially disrupting services that rely on PCRE2 pattern processing.
Mitigation Recommendations
No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance before deploying any fixes. Until a patch is available, avoid processing untrusted large patterns on affected versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-09-11T04:05:26.609Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa380d491cc7f3848a3b51f
Added to database: 09/11/2026, 04:17:24 UTC
Last enriched: 09/11/2026, 04:32:53 UTC
Last updated: 09/11/2026, 04:40:15 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.