UBUNTU-CVE-2026-86145
Dashboard / Vulnerabilities / UBUNTU-CVE-2026-86145
Summary:
Details: PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).
References: https://ubuntu.com/security/CVE-2026-86145, https://www.cve.org/CVERecord?id=CVE-2026-86145, https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf
Affected packages
Package
Name: pcre2
Purl: pkg:deb/ubuntu/pcre2?arch=source&distro=focal
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -None
Affected versions
10.32-5
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
