CVE-2026-89161: 
MariaDB Server 취약성 분석 및 완화

CVE-2026-89161 is a memory management vulnerability in PCRE2's JIT matching engine where pcre2_jit_match() mishandles a match data object that contains a previously copied subject (via PCRE2_COPY_MATCHED_SUBJECT), resulting in a memory leak and an incorrect (invalid) free operation. All PCRE2 versions before 10.48 are affected, including the 10.48-rc1 release candidate. The vulnerability was published on September 11, 2026, and patched in PCRE2 10.48 released August 31, 2026. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, PCRE2 Release).

The root cause is classified under CWE-590 (Free of Memory Not on the Heap) and CWE-1341 (Multiple Releases of Same Resource or Handle). When pcre2_jit_match() is called with a match data object that was previously used with pcre2_match() and the PCRE2_COPY_MATCHED_SUBJECT flag, the JIT fast-path function does not properly handle the stale PCRE2_MD_COPIED_SUBJECT flag in the context. This causes the previously copied subject buffer to be leaked (not freed when it should be) and then subsequently freed incorrectly — a classic double-free/invalid-free scenario. The fix, implemented in PR #937, clears the stale flag and properly releases the copied subject before the JIT path proceeds (PCRE2 PR #937, PCRE2 Release).

Successful exploitation can lead to memory corruption, information disclosure (memory leak exposing heap contents), or denial of service (crash due to invalid free). The vulnerability requires local access with low privileges and no user interaction, affecting confidentiality, integrity, and availability of the process using the vulnerable PCRE2 library. Applications and services that use PCRE2's JIT compiler and reuse match data objects across pcre2_match() and pcre2_jit_match() calls with PCRE2_COPY_MATCHED_SUBJECT are at risk, which could include web servers, scripting engines, and security tools that rely on PCRE2 for regex processing (Red Hat Advisory, PCRE2 PR #937).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Red Hat Advisory). The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as not automatable. The EPSS score is approximately 0.11%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a local attacker to control the sequence of API calls (specifically, reusing a match data object with PCRE2_COPY_MATCHED_SUBJECT via the JIT fast path), limiting its practical attack surface.

The primary remediation is to upgrade PCRE2 to version 10.48 or later, which includes the fix from PR #937 (PCRE2 Release). Backport patches for older supported releases have also been published by the PCRE2 project as part of their new five-year support lifecycle policy. Linux distributions including SUSE have released updated packages (e.g., SUSE-SU-2026:4201-1 and SUSE-SU-2026:4241-1). As a workaround where upgrading is not immediately possible, applications can avoid calling pcre2_jit_match() with match data objects previously used with pcre2_match() and PCRE2_COPY_MATCHED_SUBJECT, or disable JIT compilation entirely.

Red Hat has acknowledged the vulnerability and published a security advisory tracking it (Red Hat Advisory). Microsoft also published guidance via the MSRC update guide. SUSE issued security updates for affected packages shortly after disclosure. The oss-security mailing list carried a disclosure thread (seclists.org/oss-sec/2026/q3/723), and the Yocto Project security group flagged it for embedded Linux maintainers. Community reaction has been measured, consistent with a low-severity local vulnerability in a widely-used library.