Is CVE-2026-89156 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-89156?

CVE-2026-89156 has a CVSS v3 severity of LOW (2.9).

Back

Description

PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.