CVE-2026-89162 Information disclosure in PCRE2

Low 2.9 Published 11 Sep 2026 Updated 14 Sep 2026

An attacker with unsafe access can potentially read two bytes of memory via the pcre2_serialize_encode function in PCRE2.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-89162?

CVE-2026-89162 is a low-severity vulnerability in PCRE2, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.

Weakness: CWE-669

Which versions are affected by CVE-2026-89162?

It affects 1 product.

Products include Pcre Pcre2.

How do I fix CVE-2026-89162?

Upgrade to a fixed version.

Is CVE-2026-89162 being exploited?

There is no known exploitation of CVE-2026-89162 in the wild and no public exploit code.

Sources

Also known as ALPINE-CVE-2026-89162, BELL-CVE-2026-89162, DEBIAN-CVE-2026-89162, GHSA-mv4q-849q-vg78, GHSA-q7rw-r7qq-2hx6, MINI-r677-rvqh-gh27 and 1 more.