The pcre2 library had multiple security flaws including missing size checks leading to out-of-bounds writes (CVE-2026-86145), out-of-bounds reads triggered by invalid UTF data during JIT fallback (CVE-2026-89156), out-of-bounds writes from large pattern inputs (CVE-2026-89157), integer overflow causing out-of-bounds writes in pcre2_compile_32 on 32-bit platforms (CVE-2026-89158), out-of-bounds reads during matching of invalid UTF subjects (CVE-2026-89160), incorrect free operations in pcre2_jit_match (CVE-2026-89161), and information disclosure via pcre2_serialize_encode (CVE-2026-89162). These vulnerabilities could lead to memory corruption or data leakage if exploited. The update fixes these issues to improve security.

The vulnerabilities can lead to out-of-bounds memory reads and writes, integer overflow, incorrect memory deallocation, and information disclosure. These issues may cause application crashes, memory corruption, or leakage of sensitive information. No known exploits in the wild have been reported at this time.

A security update for pcre2 has been released that fixes all listed vulnerabilities. Users should apply the update from the vendor promptly to mitigate these issues. No additional mitigation steps are indicated beyond applying the official fix.