This security update for pcre2 addresses several vulnerabilities: CVE-2026-86145 involves missing size checks in pcre2_dfa_match causing out-of-bounds writes; CVE-2026-89156 is an out-of-bounds read triggered by invalid UTF data during JIT fallback; CVE-2026-89157 is an out-of-bounds write from large pattern input; CVE-2026-89158 involves an integer overflow leading to out-of-bounds write in pcre2_compile_32 on 32-bit platforms; CVE-2026-89160 is an out-of-bounds read during matching of invalid UTF subjects; CVE-2026-89161 is an incorrect free operation due to mishandling of copied subjects in pcre2_jit_match; and CVE-2026-89162 is an information disclosure vulnerability via pcre2_serialize_encode. These issues collectively represent serious memory safety and confidentiality risks.

The vulnerabilities can cause out-of-bounds memory reads and writes, integer overflow, improper memory deallocation, and information disclosure. These issues may lead to application crashes, memory corruption, or leakage of sensitive information. The impact is significant given the nature of memory safety violations and potential exposure of internal data.

A security update for pcre2 has been released that fixes these vulnerabilities. Users should apply the official patches provided by the SUSE Product Security Team or their respective vendors. Since this is not a cloud service, remediation depends on applying the update to affected systems. Patch status is not explicitly confirmed in the provided data; users should consult the SUSE advisory for the latest remediation guidance.