CVE-2026-86145: Red Hat Out-of-bounds write allows arbitrary code execution via crafted regular expressions
This Red Hat advisory covers CVE-2026-86145 in Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.
Key facts
- Vendor rating
- High, CVSS 8.2
- CISA KEV
- Not listed (catalogue checked )
- Affected
- < 10.48
- Fixed in
- pcre2-0:10.44-1.5.el10_2, pcre2-0:10.32-4.el8_10, pcre2-0:10.40-7.el9_8 and 17 more below
- Source published
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check).
This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API). A flaw was found in PCRE2.
An out-of-bounds write vulnerability exists in the `pcre2_dfa_match` function due to improper size checking when reusing cached workspace blocks. This could lead to data corruption or potentially arbitrary code execution, compromising the integrity and availability of the system.
Important: An out-of-bounds write vulnerability in the PCRE2 library, specifically within the `pcre2_dfa_match` function, could allow arbitrary code execution. Red Hat severity: Important — CVSS 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L).
Weakness: CWE-787.
Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Hardened Images; Red Hat Update Infrastructure 5; Red Hat OpenShift Container Platform 4.
Text from the source record.
How to fix CVE-2026-86145
Upgrade to a fixed release named by Red Hat:
- pcre2-0:10.44-1.5.el10_2
- pcre2-0:10.32-4.el8_10
- pcre2-0:10.40-7.el9_8
- pcre2-0:10.40-2.el9_2.1
- pcre2-0:10.40-5.el9_4.1
- pcre2-0:10.40-6.el9_6.1
- pcre2-main-10.48-0.1.hum1
- rhui5/cds-kubernetes-rhel9:1791978534
- rhui5/cds-rhel9:1791978528
- rhui5/haproxy-rhel9:1791978528
- rhui5/installer-rhel9:1791964013
- rhui5/rhua-rhel9:1791978693
- RHSA-2026:81522
- RHSA-2026:81613
- RHSA-2026:81532
- RHSA-2026:82876
- RHSA-2026:82875
- RHSA-2026:82845
- RHSA-2026:67534
- RHSA-2026:82939
Vendor guidance
- To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively.
Support dates for the fixed release lines
- Red Hat Enterprise Linux 10: support ends
- Red Hat Enterprise Linux 4: support ended
- Red Hat Enterprise Linux 6: support ended
CVE-2026-86145 in other vendors' advisories
- Veeam: KB4825
More Red Hat Linux advisories
CVE-2026-34486Apr 9, 2026Missing Encryption of Sensitive Data due to EncryptInterceptor bypassCVE-2026-111497Oct 22, 2026Out-of-Bounds Write in Google Brotli DecoderCVE-2026-46300May 13, 2026"Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRMCVE-2026-31431Apr 22, 2026algif_aead - Revert to operating out-of-placeCVE-2026-109619Oct 21, 2026fatal error handling retains stale request state leading to use-after-freeCVE-2026-109618Oct 21, 2026OOM bailout during request parsing leads to memory corruption and RCE
Get an email when Red Hat RHEL & SELinux publishes the next one.
See Red Hat RHEL & SELinux's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
