Summary
It was discovered that PCRE2 did not correctly manage memory when
processing certain patterns. An attacker could possibly use this issue to
execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu
22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10.
(CVE-2026-86145)
Albert Zhang discovered that PCRE2 did not correctly process certain
input. An attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,
Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-89156)
It was discovered that PCRE2 did not correctly handle large patterns. On
32-bit platforms, an attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04
LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu
26.10. (CVE-2026-89157)
It was discovered that PCRE2 did not correctly handle certain patterns.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2026-89158)
Ilia Alshanetsky discovered that PCRE2 did not correctly handle certain
input. An attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,
Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-89160)
It was discovered that PCRE2 did not correctly manage memory when handling
certain patterns. An attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04
LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10.
(CVE-2026-89161)
It was discovered that PCRE2 could expose uninitialized data in certain
circumstances. A local attacker could possibly use this issue to obtain
sensitive information. This issue only affected Ubuntu 26.04 LTS and
Ubuntu 26.10. (CVE-2026-89162)
Michael Allen discovered that PCRE2 did not correctly manage memory when
using just-in-time compilation. An attacker could possibly use this issue
to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS,
and Ubuntu 26.10. (CVE-2026-103111)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | pcre2 | 10.39-3ubuntu0.2 |
| Ubuntu · 24.04 LTS 24.04:LTS | pcre2 | 10.42-4ubuntu2.2 |
| Ubuntu · 26.04 LTS 26.04:LTS | pcre2 | 10.46-1ubuntu0.1 |
| Ubuntu · 26.10 | pcre2 | 10.46-1ubuntu1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | pcre2 | 10.21-1ubuntu0.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | pcre2 | 10.31-2ubuntu0.1~esm2 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | pcre2 | 10.34-7ubuntu0.1+esm1 |
Vulnerabilities 8
-
High 8.2
PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursi…
-
High 7.6
PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of…
-
High 7.4
In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrec…
-
Medium 6.5
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.
-
Medium 5.7
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a…
-
Low 3.7
PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF s…
-
Low 2.9
PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF d…
-
Low 2.9
In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where …
References
-
report
https://ubuntu.com/security/CVE-2026-86145
-
report
https://ubuntu.com/security/CVE-2026-89156
-
report
https://ubuntu.com/security/CVE-2026-89157
-
report
https://ubuntu.com/security/CVE-2026-89158
-
report
https://ubuntu.com/security/CVE-2026-89160
-
report
https://ubuntu.com/security/CVE-2026-89161
-
report
https://ubuntu.com/security/CVE-2026-89162
-
report
https://ubuntu.com/security/CVE-2026-103111