CVE-2026-89158: 
MariaDB Server 취약성 분석 및 완화

CVE-2026-89158 is an integer overflow vulnerability in PCRE2's pcre2_compile_32() function that results in an out-of-bounds heap write, affecting 32-bit platforms exclusively. It impacts all PCRE2 versions up to and including 10.47 (and the 10.48-rc1 release candidate); the 8-bit and 16-bit PCRE2 libraries are not affected. The vulnerability was discovered by OSS-Fuzz and publicly disclosed on September 11, 2026, with a fix released in PCRE2 10.48 on August 31, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium/High) (GitHub Advisory, Red Hat CVE).

The root cause is an integer overflow (CWE-190) in the pcre2_compile_32() function on 32-bit platforms where size_t is also 32-bit. When compiling a crafted pattern whose compiled form requires approximately 2^30 code units, the CU2BYTES() macro multiplies the code-unit count by 4 (bytes per 32-bit code unit), causing the result to wrap around to a small value. PCRE2 then allocates an undersized heap buffer and writes beyond its end during pattern compilation, constituting an out-of-bounds write (CWE-787). Exploitation requires an attacker to supply a carefully constructed, large regular expression pattern to an application that uses the 32-bit PCRE2 library in a 32-bit process; the pattern must bypass earlier overflow checks. The fix adds bounds checks and hardened arithmetic throughout the compiler's sizing pass (GitHub Advisory, PCRE2 Release).

Successful exploitation causes an out-of-bounds heap write during pattern compilation, which can corrupt process memory and potentially enable arbitrary code execution within the affected process. The CVSS scoring reflects high integrity impact and low availability impact, with no confidentiality impact. The attack is network-reachable in applications that accept user-supplied regular expressions (e.g., web application firewalls, search engines, or input validation libraries built on 32-bit PCRE2), but exploitation complexity is rated High due to the precise pattern construction required (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.0022 (0.22%), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting the high complexity required to trigger the overflow reliably (GitHub Advisory, Red Hat CVE).

1. Reconnaissance: Identify applications that accept user-supplied regular expression patterns and are compiled against the 32-bit PCRE2 library (versions ≤ 10.47) running in a 32-bit process environment.
2. Craft malicious pattern: Construct a large, specially crafted regular expression pattern whose compiled internal representation requires approximately 2^30 32-bit code units, carefully designed to bypass PCRE2's earlier overflow checks during the sizing pass.
3. Submit pattern: Supply the crafted pattern to the target application via its exposed interface (e.g., HTTP request parameter, API call, or configuration input) that passes it to pcre2_compile_32().
4. Trigger integer overflow: The CU2BYTES() macro overflows when converting code-unit count to byte size, causing PCRE2 to allocate an undersized heap buffer.
5. Out-of-bounds write: PCRE2 writes compiled pattern data beyond the end of the undersized buffer, corrupting adjacent heap memory, potentially enabling further process exploitation such as arbitrary code execution (GitHub Advisory).

• Logs: Application logs showing crashes, segmentation faults, or abnormal termination of processes using PCRE2 during regex compilation; error messages referencing memory allocation failures in pattern compilation.
• Network: Unusually large regular expression patterns submitted via HTTP requests or API calls to services that perform server-side regex compilation; repeated submission of oversized pattern strings from a single source IP.
• Process: Unexpected process crashes or core dumps from applications using the 32-bit PCRE2 library; heap corruption signals (e.g., glibc malloc abort messages such as corrupted size vs. prev_size) in system logs.
• File System: Core dump files generated by PCRE2-linked applications in /var/crash/ or the application working directory following pattern compilation attempts.

The primary remediation is to upgrade PCRE2 to version 10.48 or later, which adds bounds checks and hardened arithmetic in the compiler's sizing pass to prevent the overflow (PCRE2 Release, GitHub Advisory). SUSE has released security updates (SUSE-SU-2026:4201-1 and SUSE-SU-2026:4241-1) for affected distributions. As a workaround where immediate patching is not possible: do not compile untrusted or user-supplied patterns using the 32-bit PCRE2 library in a 32-bit process; restrict network access to applications that expose regex compilation to external input; or migrate to 64-bit builds of PCRE2, which are not affected by this vulnerability.

The vulnerability was discovered by OSS-Fuzz, demonstrating the continued value of automated fuzzing in identifying memory safety issues in widely-used libraries (GitHub Advisory). The PCRE2 10.48 release addressed multiple security issues simultaneously, including five separate security fixes, which drew attention from the Linux security community and downstream distributors such as SUSE and openSUSE. The oss-security mailing list carried a disclosure thread, and multiple Linux distribution security teams issued advisories and updates promptly following the release.