The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern matching using the same syntax and semantics as Perl. 

Security Fix(es):

* pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions (CVE-2026-86145)

* pcre2: pcre2: Out-of-bounds write via crafted regular expression (CVE-2026-103111)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: pcre2 security update

The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern matching using the same syntax and semantics as Perl. 

Security Fix(es):

* pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions (CVE-2026-86145)

* pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match (CVE-2026-89161)

* pcre2: pcre2: Out-of-bounds write via crafted regular expression (CVE-2026-103111)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.

Security Fix(es):

* pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions (CVE-2026-86145)

* pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match (CVE-2026-89161)

* pcre2: pcre2: Out-of-bounds write via crafted regular expression (CVE-2026-103111)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: mariadb11.8 security update

The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern matching using the same syntax and semantics as Perl. 

Security Fix(es):

* pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions (CVE-2026-86145)

* pcre2: PCRE2: Out-of-bounds write via large pattern input (CVE-2026-89157)

* PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms (CVE-2026-89158)

* pcre2: pcre2: Out-of-bounds write via crafted regular expression (CVE-2026-103111)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern matching using the same syntax and semantics as Perl. 

Security Fix(es):

* pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions (CVE-2026-86145)

* PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback (CVE-2026-89156)

* pcre2: PCRE2: Out-of-bounds write via large pattern input (CVE-2026-89157)

* pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching (CVE-2026-89160)

* PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms (CVE-2026-89158)

* pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match (CVE-2026-89161)

* pcre2: pcre2: Out-of-bounds write via crafted regular expression (CVE-2026-103111)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

pcre2

This update for pcre2 fixes the following issues:

- CVE-2026-86145: missing size checks in `pcre2_dfa_match` code can lead to an out-of-bounds write (bsc#1279893).
- CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback (bsc#1280054).
- CVE-2026-89157: out-of-bounds write via large pattern input (bsc#1280053).
- CVE-2026-89158: out-of-bounds write due to integer overflow in `pcre2_compile_32` for 32-bit platforms (bsc#1280052).
- CVE-2026-89160: out-of-bounds read during the `PCRE2_MATCH_INVALID_UTF` matching of an invalid UTF subject
  (bsc#1280051).
- CVE-2026-89161: incorrect free operation due to mishandling of a previously copied subject in `pcre2_jit_match`
  (bsc#1280050).
- CVE-2026-89162: information disclosure via `pcre2_serialize_encode` (bsc#1280049).

Security update for pcre2

Multiple security vulnerabilities have been identified and fixed in the pcre2 library. These include out-of-bounds reads and writes, integer overflow, incorrect memory free operations, and information disclosure issues. The flaws affect various functions such as pcre2_dfa_match, pcre2_compile_32, and pcre2_serialize_encode. These vulnerabilities can lead to memory corruption and potential information leaks. The update addresses seven distinct CVEs related to these issues.

A memory corruption vulnerability (CVE-2026-89161) was found in the PCRE2 library's just-in-time (JIT) compilation function pcre2_jit_match. This flaw can be exploited by a local attacker to cause denial of service or potentially execute arbitrary code. The vulnerability affects Red Hat Hardened Images RPMs containing PCRE2 components. The attack complexity is high and requires local access, reducing overall risk. Red Hat has released updated RPM packages to address this issue.

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2026-86145 is a high-severity vulnerability in PCRE2 versions 10.32 up to but not including 10.48. It involves an out-of-bounds write in the pcre2_dfa_match function due to improper size checking when reusing a cached workspace block during recursive DFA matching. Exploitation requires an attacker-controlled regular expression or a recursive pattern combined with a small heap limit set via the API.

Search: CVE-2026-86145