TI-2026-60395 Aliases CVE-2026-89162 GHSA-mv4q-849q-vg78

In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary…

LOW 15CWE-669Published 2026-09-11 · Updated 2026-09-14

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · None · None
Fix status: Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00156 4th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial PCRE2 (PCRE): 10.48Red Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
PCRE	PCRE2	10.45 to before 10.48	10.48	Patch available	CNA

PCRE2 VendorPCRE Affected 10.45 to before 10.48 Fixed in 10.48 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:pcre:pcre2::::::::	10.45 to before 10.48	Vulnerable	PCRE
cpe:2.3:a:pcre:pcre2:10.48:rc1::::::	10.48 rc1	Vulnerable	PCRE

cpe:2.3:a:pcre:pcre2:*:*:*:*:*:*:*:* Versions 10.45 to before 10.48 Vulnerable ·PCRE
cpe:2.3:a:pcre:pcre2:10.48:rc1:*:*:*:*:*:* Versions 10.48 rc1 Vulnerable ·PCRE

Remediation

Fix · CNA PCRE2 (PCRE) Fixed in 10.48

Red Hat 1 advisory

RHSA-2026:67534 Released 2026-09-15 · Red Hat rating Important
Red Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images pcre2-10.48-0.1.hum1@aarch64, pcre2-10.48-0.1.hum1@src, pcre2-10.48-0.1.hum1@x86_64 +12

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-09-11
PCRE PCRE2 10.48
6 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM, 4 LOW
Other records, highest priority first
- TI-2026-60391 Integer overflow in PCRE2Priority HIGH 66
- TI-2026-60393 Out-of-bounds read in PCRE2Priority MEDIUM 62
- TI-2026-60394 In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being…Priority LOW 35
Show all 6 records →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred
Red Hat Hardened Images	Fixed	RHSA-2026:67534

Not affected: 7 products

Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat Hardened Images
Red Hat OpenShift Container Platform 4
Red Hat OpenShift Container Platform 5

Timeline

2026-10-02 Threatist record created from CVE-2026-89162
2026-10-03 Alias added: GHSA-mv4q-849q-vg78
2026-11-07 Affected versions changed · Red Hat

References

Exploit 1

https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q7rw-r7qq-2hx6

Other 1

https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48

TI-2022-19872 Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a… CVSS 3.1HIGH 7.5
TI-2025-35893 PCRE2: heap-buffer-overflow read in match_ref due to missing boundary restoration in SCS CVSS 4.0MEDIUM 6.9
TI-2026-60391 Integer overflow in PCRE2 CVSS 3.1HIGH 7.4
TI-2026-60393 Out-of-bounds read in PCRE2 CVSS 3.1MEDIUM 6.5
TI-2015-02839 Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCRE2 10.10 allows remote… CVSS 3.1CRITICAL 9.8
TI-2016-02677 The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c… CVSS 3.0CRITICAL 9.8

See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences