CVE-2026-86145: pcre pcre2 Improper Protection of Alternate Path

Vulnerability summary

CVE-2026-86145 is a high (CVSS 8.2) Improper Protection of Alternate Path vulnerability in pcre pcre2. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 32.1% of scored vulnerabilities.

Timeline

1. 05-09-2026
   PublishedVulnerability first disclosed.
2. 08-09-2026
   Last modifiedVulnerability information updated.

Description

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).

• CWE-424Improper Protection of Alternate PathThe product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.