CVE-2026-89160

What it actually does

PCRE2 versions before 10.48 contain an out-of-bounds read in pcre2_match when matching with PCRE2_MATCH_INVALID_UTF against a subject that is not valid UTF. The matcher reads past the intended subject buffer, which can abort or crash the calling process. Confidentiality and integrity are unaffected; the realistic technical outcome is availability loss (process crash or worker restart), not arbitrary code execution.

Why it matters to the business

Services that compile or link against PCRE2 and apply invalid-UTF matching to untrusted input can be disrupted by crafted text, causing crashes, restarts, or degraded throughput in search, validation, or filtering paths. Severity is low (CVSS 3.7, availability only). Exploit probability remains very low (EPSS about 0.27%, flat over 30 days) and the issue is not in CISA KEV or associated with ransomware. Public exploit material exists, so regex-heavy products shipping Red Hat pcre2-main should still treat patching as a standard hygiene item rather than an emergency.

How an attack unfolds

An attacker needs a reachable application that uses PCRE2 match with PCRE2_MATCH_INVALID_UTF on attacker-influenced subject data (for example user-supplied search, filter, or validation strings). They submit a subject that is invalid UTF so that the buggy match path runs, producing an out-of-bounds read. The process typically faults or aborts, denying service for that worker or request path. No authentication is required at the library layer, but attack complexity is high because the flag, encoding, and input path must all align. Public exploit material is reported available, yet there are no named APT campaigns or KEV ransomware use for this issue.

How to fix it

Upgrade PCRE2 to 10.48 or later. For Red Hat pcre2-main, apply RHSA-2026:67534 (fixed in 10.48-0.1.hum1). Rebuild or restart any statically linked or long-running consumers so they load the patched library. If immediate upgrade is not possible, avoid enabling PCRE2_MATCH_INVALID_UTF on untrusted subjects, or reject/normalize non-UTF input before matching. Inventory downstream packages that vendor or statically link libpcre2 and update those as well.

How to confirm the fix worked

Confirm installed PCRE2 is 10.48 or newer (Red Hat: pcre2-main 10.48-0.1.hum1 or later per RHSA-2026:67534). Verify running processes map the patched libpcre2 rather than a pre-10.48 copy, including containers and statically linked binaries. After upgrade, regression-test match paths that use PCRE2_MATCH_INVALID_UTF with both valid and invalid UTF subjects to ensure they no longer crash. Package and SBOM scans should flag any remaining pcre2 older than 10.48.

Typical attack path

1. Locate an application or service that links PCRE2 and evaluates untrusted input with PCRE2_MATCH_INVALID_UTF enabled.
2. Submit a subject string that is not valid UTF into that match path (search, filter, rewrite, or validation).
3. Trigger pcre2_match’s out-of-bounds read on the invalid UTF subject.
4. Cause the worker or process to crash or abort, repeating as needed to sustain denial of service.

How to detect it

This is an in-process out-of-bounds read, so evidence of prior exploitation is crash and abort telemetry rather than a unique network payload. Review application, systemd/journal, container, and crash-reporter logs around 2026-09-11 onward for fatal signals (SIGSEGV/SIGABRT) with pcre2_match or libpcre2 on the stack, especially on workers that handle search or validation of user text. Core dumps and sanitizer reports citing an out-of-bounds read during PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject are the strongest artifacts. Correlate bursts of 5xx/worker restarts with clients submitting non-UTF bodies. There are no named threat actors; treat repeated crashes after crafted text as suspicious given that exploit code is publicly available.

• pcre2_match
• PCRE2_MATCH_INVALID_UTF
• libpcre2
• libpcre2-8.so
• invalid UTF subject
• SIGSEGV
• SIGABRT
• out-of-bounds read

What your security team should do

• Patch Red Hat pcre2-main to 10.48-0.1.hum1 (RHSA-2026:67534) and restart consumers so they load the new library.
• Inventory applications that enable PCRE2_MATCH_INVALID_UTF on untrusted input and treat those as the priority blast radius.
• Until patched, disable PCRE2_MATCH_INVALID_UTF or reject non-UTF subjects before matching.
• Hunt for repeated crashes in pcre2_match; public exploit material exists even though EPSS and KEV risk remain low.
• Track statically linked and containerized copies of libpcre2 that package managers will not update automatically.