CVE-2026-89162: 
MariaDB Server 취약성 분석 및 완화

CVE-2026-89162 is a low-severity uninitialized memory disclosure vulnerability in the PCRE2 library's pcre2_serialize_encode() function. It affects PCRE2 versions 10.45 through 10.47 (before 10.48), and was publicly disclosed on September 11, 2026. The flaw can cause two bytes of uninitialized heap memory from prior allocations to be included in serialized regex output. It carries a CVSS v3.1 base score of 3.3 (Low) per Red Hat, or 2.9 (Low) per the upstream advisory (PCRE2 Advisory, Red Hat Bugzilla).

The root cause is the use of uninitialized memory (CWE-908) combined with incorrect resource transfer between spheres (CWE-669). During compilation of certain regular expressions — particularly those involving Unicode character classes (e.g., [\H] with PCRE2_UTF, or [z-\x{100}] with PCRE2_CASELESS | PCRE2_UTF) — two bytes within the compiled structure's internal data layout are left uninitialized by pcre2_compile_class.c. When pcre2_serialize_encode() subsequently serializes the compiled code object, these two uninitialized bytes (detectable at a predictable offset, e.g., offset 1256 in the PoC) are copied verbatim into the output buffer, potentially containing residual heap content from prior allocations. Debug and Valgrind builds include a guard that initializes these bytes to 0x5555, but normal production builds do not (PCRE2 Advisory).

The vulnerability results in a limited confidentiality impact: up to two bytes of uninitialized heap memory may be disclosed to an adversary who has access to the serialized regex output. There is no impact on integrity or availability. The practical severity is constrained by the fact that the attacker has little control over which two bytes are exposed, and that exposing serialized PCRE2 output to untrusted parties is itself considered an unsafe practice (since pcre2_serialize_decode() is not designed to accept untrusted data). No lateral movement or privilege escalation is enabled by this vulnerability alone (PCRE2 Advisory, Github Advisory).

A proof-of-concept C program is publicly available in the upstream PCRE2 security advisory, demonstrating the uninitialized memory disclosure via Valgrind. There is no evidence of in-the-wild exploitation, and the NVD SSVC assessment confirms exploitation is currently "none." The EPSS score is approximately 0.105–0.155%, placing it in a low percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (PCRE2 Advisory, Github Advisory).

1. Identify target: Confirm the target application links against PCRE2 versions 10.45–10.47 and exposes serialized regex output (e.g., via a file, IPC, or network channel accessible to the attacker.
2. Craft regex pattern: Prepare a regular expression using Unicode character classes, such as [\H] (non-horizontal whitespace) with the PCRE2_UTF compile option, or [z-\x{100}] with PCRE2_CASELESS | PCRE2_UTF.
3. Trigger compilation and serialization: Cause the application to call pcre2_compile() with the crafted pattern and then pcre2_serialize_encode() on the resulting compiled code object.
4. Obtain serialized output: Access the serialized byte buffer produced by pcre2_serialize_encode().
5. Extract uninitialized bytes: Read the two uninitialized bytes at the predictable offset within the serialized buffer (e.g., offset 1256 as shown in the PoC); these bytes may contain residual heap data from prior memory allocations on the target system (PCRE2 Advisory).

The fix is included in PCRE2 version 10.48, released August 31, 2026, which initializes the two previously uninitialized bytes before serialization. Users should upgrade to PCRE2 10.48 or later as the primary remediation. As a workaround where upgrading is not immediately possible, restrict access to serialized PCRE2 output so it is never exposed to untrusted parties, and apply the principle of least privilege to limit which users or processes can invoke pcre2_serialize_encode() functionality. Fedora and Red Hat package updates are tracked under Bugzilla bug 2531748 (PCRE2 Release, Red Hat Bugzilla).

The vulnerability was originally reported to the PCRE2 project by the Erlang/OTP team, who noted they do not consider it a serious vulnerability for their users and did not plan to file a separate CVE for Erlang/OTP. The upstream PCRE2 maintainers classified it as "low severity" and addressed it as part of the regular 10.48 release. The oss-security mailing list carried a disclosure thread, and the issue received routine coverage from vulnerability aggregators without significant community alarm (PCRE2 Advisory, oss-sec).