Re: pcre2 version 10.48 released with security fixes

[Alan Coopersmith <alan.coopersmith () oracle com>]

On 9/4/26 16:25, Alan Coopersmith wrote:
> > * (Security fix for very specific API usage, GHSA-2p8c-ff85-vh9x) If
> > pcre2_jit_compile() is called with options for some match modes, and then
> > pcre2_match() is used to perform a match for a different match mode, an
> > out-of-bounds read can occur if the match is attempted against invalid UTF input.

This is now assigned CVE-2026-89156.

> > * (Security fix for pattern conversion, GHSA-q8g2-wprr-34m9) If pcre2_convert()
> > is called on untrusted input on platforms with 32-bit size_t, an out-of-bounds
> > heap write can occur.

This is now assigned CVE-2026-89157.

> > * (Security fix, GHSA-3r4p-g7gg-ppmf) Fixed an out-of-bounds write in DFA
> > matching when using a heap limit; also fixed possible integer overflows which
> > could cause under-allocation of the workspace.

As Salvatore previously noted, this one got CVE-2026-86145.

> > * (Security fix, GHSA-fmgr-6ggq-9859) Added bounds checks for several integer
> > overflows while compiling patterns on 32-bit CPUs, which could cause
> > under-allocation followed by out-of-bounds writes.

This is now assigned CVE-2026-89158.

> > * (Security fix, GHSA-9qww-pwc4-77qq) Applied lower buffer bound to prevent
> > two out-of-bounds reads while scanning backwards through invalid UTF data with
> > PCRE2_MATCH_INVALID_UTF.

This is now assigned CVE-2026-89160.

> > * (Security fix for very specific API usage, #937) Fixed a leak and later
> > invalid free when calling the fast-path pcre2_jit_match() function with a match
> > data object previously used with pcre2_match() and
> > PCRE2_COPY_MATCHED_SUBJECT.

This is now assigned CVE-2026-89161.

> > * (Low-severity security fix, GHSA-q7rw-r7qq-2hx6) Fixed exposure of two
> > uninitialised bytes from malloc() via pcre2_serialize_encode().

This is now assigned CVE-2026-89162.

--
        -Alan Coopersmith-                 alan.coopersmith () oracle com
         Oracle Solaris Engineering - https://blogs.oracle.com/solaris