# CVE-2026-89156: PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.

CVE-2026-89156 is fixed in 25 products on 1 platform, first by RHSA-2026:81522, released September 11, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-89156
- Priority: High
- CVSS: 8.2 (Low)
- EPSS: 0.0029
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 10, 2026
- Weakness: Out-of-bounds Read
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-89156

## Description

PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libpcre2-16-0 Ubuntu 20.04 LTS (focal) | 10.34-7ubuntu0.1+esm1 | [libpcre2-16-0 10.34-7ubuntu0.1+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libpcre2-16-0-10.34-7ubuntu0.1-esm1.md) | Sep 29, 2026 |
| Linux | libpcre2-16-0 Ubuntu 22.04.1 LTS (jammy) | 10.39-3ubuntu0.2 | [libpcre2-16-0 10.39-3ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libpcre2-16-0-10.39-3ubuntu0.2.md) | Sep 29, 2026 |
| Linux | libpcre2-16-0 Ubuntu 24.04.5 LTS (noble) | 10.42-4ubuntu2.2 | [libpcre2-16-0 10.42-4ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libpcre2-16-0-10.42-4ubuntu2.2.md) | Sep 29, 2026 |
| Linux | libpcre2-16-0 Ubuntu 26.04.1 LTS (resolute) | 10.46-1ubuntu0.1 | [libpcre2-16-0 10.46-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libpcre2-16-0-10.46-1ubuntu0.1.md) | Sep 29, 2026 |
| Linux | libpcre2-32-0 Ubuntu 20.04 LTS (focal) | 10.34-7ubuntu0.1+esm1 | [libpcre2-32-0 10.34-7ubuntu0.1+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libpcre2-32-0-10.34-7ubuntu0.1-esm1.md) | Sep 29, 2026 |
| Linux | libpcre2-32-0 Ubuntu 22.04.1 LTS (jammy) | 10.39-3ubuntu0.2 | [libpcre2-32-0 10.39-3ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libpcre2-32-0-10.39-3ubuntu0.2.md) | Sep 29, 2026 |
| Linux | libpcre2-32-0 Ubuntu 24.04.5 LTS (noble) | 10.42-4ubuntu2.2 | [libpcre2-32-0 10.42-4ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libpcre2-32-0-10.42-4ubuntu2.2.md) | Sep 29, 2026 |
| Linux | libpcre2-32-0 Ubuntu 26.04.1 LTS (resolute) | 10.46-1ubuntu0.1 | [libpcre2-32-0 10.46-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libpcre2-32-0-10.46-1ubuntu0.1.md) | Sep 29, 2026 |
| Linux | libpcre2-8-0 Ubuntu 20.04 LTS (focal) | 10.34-7ubuntu0.1+esm1 | [libpcre2-8-0 10.34-7ubuntu0.1+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libpcre2-8-0-10.34-7ubuntu0.1-esm1.md) | Sep 29, 2026 |
| Linux | libpcre2-8-0 Ubuntu 22.04.1 LTS (jammy) | 10.39-3ubuntu0.2 | [libpcre2-8-0 10.39-3ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libpcre2-8-0-10.39-3ubuntu0.2.md) | Sep 29, 2026 |
| Linux | libpcre2-8-0 Ubuntu 24.04.5 LTS (noble) | 10.42-4ubuntu2.2 | [libpcre2-8-0 10.42-4ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libpcre2-8-0-10.42-4ubuntu2.2.md) | Sep 29, 2026 |
| Linux | libpcre2-8-0 Ubuntu 26.04.1 LTS (resolute) | 10.46-1ubuntu0.1 | [libpcre2-8-0 10.46-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libpcre2-8-0-10.46-1ubuntu0.1.md) | Sep 29, 2026 |
| Linux | libpcre2-posix2 Ubuntu 20.04 LTS (focal) | 10.34-7ubuntu0.1+esm1 | [libpcre2-posix2 10.34-7ubuntu0.1+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libpcre2-posix2-10.34-7ubuntu0.1-esm1.md) | Sep 29, 2026 |
| Linux | libpcre2-posix3 Ubuntu 22.04.1 LTS (jammy) | 10.39-3ubuntu0.2 | [libpcre2-posix3 10.39-3ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libpcre2-posix3-10.39-3ubuntu0.2.md) | Sep 29, 2026 |
| Linux | libpcre2-posix3 Ubuntu 24.04.5 LTS (noble) | 10.42-4ubuntu2.2 | [libpcre2-posix3 10.42-4ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libpcre2-posix3-10.42-4ubuntu2.2.md) | Sep 29, 2026 |
| Linux | libpcre2-posix3 Ubuntu 26.04.1 LTS (resolute) | 10.46-1ubuntu0.1 | [libpcre2-posix3 10.46-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libpcre2-posix3-10.46-1ubuntu0.1.md) | Sep 29, 2026 |
| Linux | mingw-pcre2 Fedora 43 | 10.48-1.fc43 | [FEDORA-2026-98F3F016C4](https://patchblox.com/security/data/fix/linux/fedora-2026-98f3f016c4.md) | Sep 15, 2026 |
| Linux | mingw32-pcre2 Fedora 43 | 10.48-1.fc43 | [FEDORA-2026-98F3F016C4](https://patchblox.com/security/data/fix/linux/fedora-2026-98f3f016c4.md) | Sep 15, 2026 |
| Linux | mingw32-pcre2-debuginfo Fedora 43 | 10.48-1.fc43 | [FEDORA-2026-98F3F016C4](https://patchblox.com/security/data/fix/linux/fedora-2026-98f3f016c4.md) | Sep 15, 2026 |
| Linux | mingw32-pcre2-static Fedora 43 | 10.48-1.fc43 | [FEDORA-2026-98F3F016C4](https://patchblox.com/security/data/fix/linux/fedora-2026-98f3f016c4.md) | Sep 15, 2026 |
| Linux | mingw64-pcre2 Fedora 43 | 10.48-1.fc43 | [FEDORA-2026-98F3F016C4](https://patchblox.com/security/data/fix/linux/fedora-2026-98f3f016c4.md) | Sep 15, 2026 |
| Linux | mingw64-pcre2-debuginfo Fedora 43 | 10.48-1.fc43 | [FEDORA-2026-98F3F016C4](https://patchblox.com/security/data/fix/linux/fedora-2026-98f3f016c4.md) | Sep 15, 2026 |
| Linux | mingw64-pcre2-static Fedora 43 | 10.48-1.fc43 | [FEDORA-2026-98F3F016C4](https://patchblox.com/security/data/fix/linux/fedora-2026-98f3f016c4.md) | Sep 15, 2026 |
| Linux | pcre2 Debian 12.15 (bookworm) | 10.42-1+deb12u1 | [DEBIAN-CVE-2026-89156](https://patchblox.com/security/data/fix/linux/debian-cve-2026-89156.md) | Sep 11, 2026 |
| Linux | pcre2 Debian 13.5 (trixie) | 10.46-1~deb13u2 | [DEBIAN-CVE-2026-89156](https://patchblox.com/security/data/fix/linux/debian-cve-2026-89156.md) | Sep 11, 2026 |
| Linux | pcre2 Debian 14 | 10.48-1 | [DEBIAN-CVE-2026-89156](https://patchblox.com/security/data/fix/linux/debian-cve-2026-89156.md) | Sep 11, 2026 |
| Linux | pcre2 RHEL 10 | 10.44-1.5.el10_2 | [RHSA-2026:81522](https://patchblox.com/security/data/fix/linux/rhsa-2026-81522.md) | Sep 11, 2026 |
| Linux | pcre2 RHEL 9 | 0:10.40-7.el9_8 | [RHSA-2026:81532](https://patchblox.com/security/data/fix/linux/rhsa-2026-81532.md) | Oct 13, 2026 |
| Linux | pcre2 almalinux 10 | 10.44-1.5.el10_2 | [ALSA-2026:81522](https://patchblox.com/security/data/fix/linux/alsa-2026-81522.md) | Nov 7, 2026 |
| Linux | pcre2 almalinux 9 | 10.40-7.el9_8 | [ALSA-2026:81532](https://patchblox.com/security/data/fix/linux/alsa-2026-81532.md) | Nov 7, 2026 |
| Linux | pcre2 amzn 2023 | 10.40-1.amzn2023.0.5 | [ALAS2023-2026-3269](https://patchblox.com/security/data/fix/linux/alas2023-2026-3269.md) | Nov 7, 2026 |
| Linux | pcre2 ol 10 | 0:10.44-1.5.0.1.el10_2 | [ELSA-2026-81522](https://patchblox.com/security/data/fix/linux/elsa-2026-81522.md) | Nov 7, 2026 |
| Linux | pcre2 ol 9 | 0:10.40-7.0.1.el9_8 | [ELSA-2026-81532](https://patchblox.com/security/data/fix/linux/elsa-2026-81532.md) | Nov 7, 2026 |
| Linux | pcre2 opensuse-leap 16.0 | 10.45-160000.4.1 | [OPENSUSE-SU-2026:21938-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21938-1.md) | Sep 23, 2026 |
| Linux | pcre2 rocky 10 | 0:10.44-1.5.el10_2 | [RLSA-2026:81522](https://patchblox.com/security/data/fix/linux/rlsa-2026-81522.md) | Nov 7, 2026 |
| Linux | pcre2 rocky 9 | 0:10.40-7.el9_8 | [RLSA-2026:81532](https://patchblox.com/security/data/fix/linux/rlsa-2026-81532.md) | Nov 7, 2026 |
| Linux | pcre2 sles 15.6 | 10.42-150600.3.3.1 | [SUSE-SU-2026:4241-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4241-1.md) | Sep 17, 2026 |
| Linux | pcre2 sles 15.7 | 10.42-150600.3.3.1 | [SUSE-SU-2026:4241-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4241-1.md) | Sep 17, 2026 |
| Linux | pcre2 sles 16.0 | 10.45-160000.4.1 | [SUSE-SU-2026:23906-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23906-1.md) | Sep 23, 2026 |
| Linux | pcre2-debuginfo amzn 2023 | 10.40-1.amzn2023.0.5 | [ALAS2023-2026-3269](https://patchblox.com/security/data/fix/linux/alas2023-2026-3269.md) | Nov 7, 2026 |
| Linux | pcre2-debugsource amzn 2023 | 10.40-1.amzn2023.0.5 | [ALAS2023-2026-3269](https://patchblox.com/security/data/fix/linux/alas2023-2026-3269.md) | Nov 7, 2026 |
| Linux | pcre2-devel RHEL 9 | 0:10.40-7.el9_8 | [RHSA-2026:81532](https://patchblox.com/security/data/fix/linux/rhsa-2026-81532.md) | Oct 13, 2026 |
| Linux | pcre2-devel almalinux 10 | 10.44-1.5.el10_2 | [ALSA-2026:81522](https://patchblox.com/security/data/fix/linux/alsa-2026-81522.md) | Nov 7, 2026 |
| Linux | pcre2-devel almalinux 9 | 10.40-7.el9_8 | [ALSA-2026:81532](https://patchblox.com/security/data/fix/linux/alsa-2026-81532.md) | Nov 7, 2026 |
| Linux | pcre2-devel amzn 2023 | 10.40-1.amzn2023.0.5 | [ALAS2023-2026-3269](https://patchblox.com/security/data/fix/linux/alas2023-2026-3269.md) | Nov 7, 2026 |
| Linux | pcre2-devel ol 10 | 0:10.44-1.5.0.1.el10_2 | [ELSA-2026-81522](https://patchblox.com/security/data/fix/linux/elsa-2026-81522.md) | Nov 7, 2026 |
| Linux | pcre2-devel ol 9 | 0:10.40-7.0.1.el9_8 | [ELSA-2026-81532](https://patchblox.com/security/data/fix/linux/elsa-2026-81532.md) | Nov 7, 2026 |
| Linux | pcre2-static almalinux 10 | 10.44-1.5.el10_2 | [ALSA-2026:81522](https://patchblox.com/security/data/fix/linux/alsa-2026-81522.md) | Nov 7, 2026 |
| Linux | pcre2-static amzn 2023 | 10.40-1.amzn2023.0.5 | [ALAS2023-2026-3269](https://patchblox.com/security/data/fix/linux/alas2023-2026-3269.md) | Nov 7, 2026 |
| Linux | pcre2-static ol 10 | 0:10.44-1.5.0.1.el10_2 | [ELSA-2026-81522](https://patchblox.com/security/data/fix/linux/elsa-2026-81522.md) | Nov 7, 2026 |
| Linux | pcre2-syntax RHEL 9 | 0:10.40-7.el9_8 | [RHSA-2026:81532](https://patchblox.com/security/data/fix/linux/rhsa-2026-81532.md) | Oct 13, 2026 |
| Linux | pcre2-syntax almalinux 10 | 10.44-1.5.el10_2 | [ALSA-2026:81522](https://patchblox.com/security/data/fix/linux/alsa-2026-81522.md) | Nov 7, 2026 |
| Linux | pcre2-syntax almalinux 9 | 10.40-7.el9_8 | [ALSA-2026:81532](https://patchblox.com/security/data/fix/linux/alsa-2026-81532.md) | Nov 7, 2026 |
| Linux | pcre2-syntax amzn 2023 | 10.40-1.amzn2023.0.5 | [ALAS2023-2026-3269](https://patchblox.com/security/data/fix/linux/alas2023-2026-3269.md) | Nov 7, 2026 |
| Linux | pcre2-syntax ol 10 | 0:10.44-1.5.0.1.el10_2 | [ELSA-2026-81522](https://patchblox.com/security/data/fix/linux/elsa-2026-81522.md) | Nov 7, 2026 |
| Linux | pcre2-syntax ol 9 | 0:10.40-7.0.1.el9_8 | [ELSA-2026-81532](https://patchblox.com/security/data/fix/linux/elsa-2026-81532.md) | Nov 7, 2026 |
| Linux | pcre2-tools RHEL 9 | 0:10.40-7.el9_8 | [RHSA-2026:81532](https://patchblox.com/security/data/fix/linux/rhsa-2026-81532.md) | Oct 13, 2026 |
| Linux | pcre2-tools almalinux 10 | 10.44-1.5.el10_2 | [ALSA-2026:81522](https://patchblox.com/security/data/fix/linux/alsa-2026-81522.md) | Nov 7, 2026 |
| Linux | pcre2-tools almalinux 9 | 10.40-7.el9_8 | [ALSA-2026:81532](https://patchblox.com/security/data/fix/linux/alsa-2026-81532.md) | Nov 7, 2026 |
| Linux | pcre2-tools amzn 2023 | 10.40-1.amzn2023.0.5 | [ALAS2023-2026-3269](https://patchblox.com/security/data/fix/linux/alas2023-2026-3269.md) | Nov 7, 2026 |
| Linux | pcre2-tools ol 10 | 0:10.44-1.5.0.1.el10_2 | [ELSA-2026-81522](https://patchblox.com/security/data/fix/linux/elsa-2026-81522.md) | Nov 7, 2026 |
| Linux | pcre2-tools ol 9 | 0:10.40-7.0.1.el9_8 | [ELSA-2026-81532](https://patchblox.com/security/data/fix/linux/elsa-2026-81532.md) | Nov 7, 2026 |
| Linux | pcre2-tools-debuginfo amzn 2023 | 10.40-1.amzn2023.0.5 | [ALAS2023-2026-3269](https://patchblox.com/security/data/fix/linux/alas2023-2026-3269.md) | Nov 7, 2026 |
| Linux | pcre2-utf16 RHEL 9 | 0:10.40-7.el9_8 | [RHSA-2026:81532](https://patchblox.com/security/data/fix/linux/rhsa-2026-81532.md) | Oct 13, 2026 |
| Linux | pcre2-utf16 almalinux 10 | 10.44-1.5.el10_2 | [ALSA-2026:81522](https://patchblox.com/security/data/fix/linux/alsa-2026-81522.md) | Nov 7, 2026 |
| Linux | pcre2-utf16 almalinux 9 | 10.40-7.el9_8 | [ALSA-2026:81532](https://patchblox.com/security/data/fix/linux/alsa-2026-81532.md) | Nov 7, 2026 |
| Linux | pcre2-utf16 amzn 2023 | 10.40-1.amzn2023.0.5 | [ALAS2023-2026-3269](https://patchblox.com/security/data/fix/linux/alas2023-2026-3269.md) | Nov 7, 2026 |
| Linux | pcre2-utf16 ol 10 | 0:10.44-1.5.0.1.el10_2 | [ELSA-2026-81522](https://patchblox.com/security/data/fix/linux/elsa-2026-81522.md) | Nov 7, 2026 |
| Linux | pcre2-utf16 ol 9 | 0:10.40-7.0.1.el9_8 | [ELSA-2026-81532](https://patchblox.com/security/data/fix/linux/elsa-2026-81532.md) | Nov 7, 2026 |
| Linux | pcre2-utf16-debuginfo amzn 2023 | 10.40-1.amzn2023.0.5 | [ALAS2023-2026-3269](https://patchblox.com/security/data/fix/linux/alas2023-2026-3269.md) | Nov 7, 2026 |
| Linux | pcre2-utf32 RHEL 9 | 0:10.40-7.el9_8 | [RHSA-2026:81532](https://patchblox.com/security/data/fix/linux/rhsa-2026-81532.md) | Oct 13, 2026 |
| Linux | pcre2-utf32 almalinux 10 | 10.44-1.5.el10_2 | [ALSA-2026:81522](https://patchblox.com/security/data/fix/linux/alsa-2026-81522.md) | Nov 7, 2026 |
| Linux | pcre2-utf32 almalinux 9 | 10.40-7.el9_8 | [ALSA-2026:81532](https://patchblox.com/security/data/fix/linux/alsa-2026-81532.md) | Nov 7, 2026 |
| Linux | pcre2-utf32 amzn 2023 | 10.40-1.amzn2023.0.5 | [ALAS2023-2026-3269](https://patchblox.com/security/data/fix/linux/alas2023-2026-3269.md) | Nov 7, 2026 |
| Linux | pcre2-utf32 ol 10 | 0:10.44-1.5.0.1.el10_2 | [ELSA-2026-81522](https://patchblox.com/security/data/fix/linux/elsa-2026-81522.md) | Nov 7, 2026 |
| Linux | pcre2-utf32 ol 9 | 0:10.40-7.0.1.el9_8 | [ELSA-2026-81532](https://patchblox.com/security/data/fix/linux/elsa-2026-81532.md) | Nov 7, 2026 |
| Linux | pcre2-utf32-debuginfo amzn 2023 | 10.40-1.amzn2023.0.5 | [ALAS2023-2026-3269](https://patchblox.com/security/data/fix/linux/alas2023-2026-3269.md) | Nov 7, 2026 |
| Linux | pcre2-utils Ubuntu 20.04 LTS (focal) | 10.34-7ubuntu0.1+esm1 | [pcre2-utils 10.34-7ubuntu0.1+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-pcre2-utils-10.34-7ubuntu0.1-esm1.md) | Sep 29, 2026 |
| Linux | pcre2-utils Ubuntu 22.04.1 LTS (jammy) | 10.39-3ubuntu0.2 | [pcre2-utils 10.39-3ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-pcre2-utils-10.39-3ubuntu0.2.md) | Sep 29, 2026 |
| Linux | pcre2-utils Ubuntu 24.04.5 LTS (noble) | 10.42-4ubuntu2.2 | [pcre2-utils 10.42-4ubuntu2.2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-pcre2-utils-10.42-4ubuntu2.2.md) | Sep 29, 2026 |
| Linux | pcre2-utils Ubuntu 26.04.1 LTS (resolute) | 10.46-1ubuntu0.1 | [pcre2-utils 10.46-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-pcre2-utils-10.46-1ubuntu0.1.md) | Sep 29, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.