CVE-2026-86145

Name of the Vulnerable Software and Affected Versions PCRE2 versions prior to 10.48

Description An out-of-bounds write occurs in the pcre2 dfa match() function due to a missing size check when reusing a cached workspace block within a recursive Deterministic Finite Automaton (DFA) matching workspace. While newly allocated blocks are checked, cached blocks are not. This issue can be triggered by an attacker-controlled regular expression or a recursive pattern combined with a small heap limit configured via the API.

Recommendations Update to version 10.48 or later.