Red Hat Issues Fixes for Seven PCRE2 Library Flaws Including Out of Bounds Writes and a Denial of Service
Red Hat published security advisory RHSA-2026:81522 on 12 October 2026, an update for the pcre2 package on Red Hat Enterprise Linux 10 that the vendor rates as Important. The update addresses seven separate vulnerabilities in the Perl Compatible Regular Expression version 2 libraries: CVE-2026-86145, CVE-2026-89156, CVE-2026-89157, CVE-2026-89158, CVE-2026-89160, CVE-2026-89161 and CVE-2026-103111. The affected footprint is broad because pcre2 ships as a base operating system component rather than an optional add-on. Red Hat lists Red Hat Enterprise Linux 10 and the Extended Update Support, four-years-of-updates and Extended Life Cycle 10.2 streams across all four supported architectures, x86_64, aarch64, ppc64le and s390x, along with the matching CodeReady Linux Builder repositories. The corrected package is pcre2-10.44-1.5.el10_2, which also covers the pcre2-utf16, pcre2-utf32, pcre2-devel, pcre2-syntax and pcre2-tools sub-packages built from the same source RPM.
Red Hat has not published exploitation details or proof-of-concept material in the advisory itself, so the mechanism is known only to the extent the CVE titles and linked Bugzilla entries describe it. Five of the seven issues are memory write or corruption conditions. CVE-2026-86145 is an out-of-bounds write that the vendor states allows arbitrary code execution through a crafted regular expression, and CVE-2026-103111 is a further out-of-bounds write triggered by a crafted pattern. CVE-2026-89157 is an out-of-bounds write reached through a large pattern input, while CVE-2026-89158 is an out-of-bounds write caused by an integer overflow that the vendor scopes specifically to 32-bit platforms, and CVE-2026-89161 is a memory corruption flaw in the pcre2_jit_match function. The remaining two are read-side issues tied to Unicode handling: CVE-2026-89156 is an out-of-bounds read triggered by invalid UTF data during JIT fallback, and CVE-2026-89160 is a denial of service arising from an out-of-bounds read during invalid UTF matching. The common thread across the set is attacker influence over either the regular expression pattern being compiled or the subject data being matched, with two of the flaws specifically touching the just-in-time compiler path rather than the interpreted matcher.
The significance of this advisory lies less in any single CVE than in where the library sits. PCRE2 is linked by web servers, scripting language runtimes, log and text processing tools, configuration parsers, identity components and countless application packages, which means untrusted input routinely reaches it on systems whose owners do not think of themselves as running a regular expression engine at all. A memory-safety defect in that position inherits the privilege level of whatever process loaded the library, so the practical consequence ranges from a crashed service on an edge host to code execution inside a long-running daemon, depending entirely on the calling application. The 32-bit scoping of CVE-2026-89158 narrows that one issue, but the other six are not architecture-limited. On current exploitation status, FIRST EPSS scores all seven low: CVE-2026-86145 at 0.4 percent probability of exploitation in the next 30 days, CVE-2026-89156, CVE-2026-89157 and CVE-2026-89160 at 0.3 percent, CVE-2026-89158 and CVE-2026-103111 at 0.2 percent, and CVE-2026-89161 at 0.1 percent. Neither the advisory nor the exploitation data indicates in-the-wild activity, public exploit code or inclusion in any known-exploited catalogue, and the fixed packages were available at the time of publication. The realistic exposure window is therefore the gap between release and rollout across a fleet, which for a shared library also depends on dependent services being restarted so the new code is actually mapped into memory.
Attack Surface
Server OS, Endpoint OS, Web Application
Tactics
Execution, Impact, Initial Access
Techniques
- T1190 – Exploit Public-Facing Application
- T1203 – Exploitation for Client Execution
- T1499 – Endpoint Denial of Service
- T1499.004 – Application or System Exploitation
SuperPRO's Threat Countermeasures Procedures
- Apply Red Hat errata RHSA-2026:81522, which delivers the corrected pcre2 package at version 10.44-1.5.el10_2, following the update procedure referenced in the Solution section of that advisory.
- Compare installed package versions against the fixed versions published in RHSA-2026:81522 for pcre2, pcre2-utf16, pcre2-utf32, pcre2-devel, pcre2-syntax and pcre2-tools; any build below 10.44-1.5.el10_2 remains affected.
- Cover every product stream the errata lists as affected, namely Red Hat Enterprise Linux 10 and the 10.2 Extended Update Support, four-years-of-updates and Extended Life Cycle streams, on the x86_64, aarch64, ppc64le and s390x architectures.
- Include the CodeReady Linux Builder repositories named in RHSA-2026:81522, which deliver pcre2-devel to build and developer systems that are easily missed when only production RHEL 10 hosts are patched.
- Track the seven flaws individually through the CVE pages linked from the errata for CVE-2026-86145, CVE-2026-89156, CVE-2026-89157, CVE-2026-89158, CVE-2026-89160, CVE-2026-89161 and CVE-2026-103111, which carry Red Hat's per-flaw impact and scope statements.
- Note Red Hat's scoping of CVE-2026-89158 to 32-bit platforms when assessing exposure, as the errata states the integer overflow leading to the out-of-bounds write applies there while the remaining six flaws are not architecture-limited.
- Beyond the errata, which offers no guidance for already-running processes, restart long-lived services that still map the previous libpcre2 shared object after the package upgrade, since they continue executing the old code until restarted.
