CVE-2026-89158: 
MariaDB Server vulnerability analysis and mitigation

CVE-2026-89158 is an integer overflow vulnerability in PCRE2's pcre2_compile_32() function that results in an out-of-bounds heap write on 32-bit platforms. It affects all PCRE2 versions up to and including 10.47, with the fix introduced in version 10.48. The vulnerability was discovered by OSS-Fuzz and publicly disclosed on September 11, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium/High) (GitHub Advisory, Red Hat).

The root cause is an integer overflow (CWE-190) in the byte-size calculation within pcre2_compile_32() on 32-bit systems where size_t is also 32-bit. When a crafted pattern requires approximately 2^30 code units in compiled form, the CU2BYTES() macro multiplies the code-unit count by 4 (bytes per 32-bit code unit), causing the result to wrap around to a small value. This leads to an undersized heap allocation, followed by an out-of-bounds write (CWE-787) as the compiler writes beyond the buffer boundary. Exploitation requires an attacker to supply a carefully crafted, large regular expression pattern to an application that uses the 32-bit PCRE2 library in a 32-bit process; the 8-bit and 16-bit PCRE2 libraries are not affected. The vulnerability was discovered via OSS-Fuzz fuzzing infrastructure (GitHub Advisory, PCRE2 Release).

Successful exploitation causes an out-of-bounds heap write during pattern compilation, which can corrupt adjacent heap memory. This may lead to data integrity compromise (rated High for integrity impact) or, under favorable memory layout conditions, arbitrary code execution within the affected process. Availability impact is rated Low, and there is no confidentiality impact. The PCRE2 maintainers note that additional process exploitation beyond memory corruption should be assumed possible (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (GitHub Advisory). The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting the high attack complexity required to craft a pattern that bypasses earlier overflow checks. The EPSS score is approximately 0.22%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Nessus detection plugin 346792 is available for scanning (Feedly).

1. Identify target application: Locate an application that accepts user-supplied regular expression patterns and compiles them using the 32-bit PCRE2 library (pcre2_compile_32()) running in a 32-bit process environment.
2. Craft malicious pattern: Construct a large, specially crafted regex pattern whose compiled representation requires approximately 2^30 32-bit code units. The pattern must be designed to bypass earlier overflow checks within the PCRE2 compiler's sizing pass.
3. Submit pattern: Supply the crafted pattern to the target application through its normal input interface (e.g., API endpoint, configuration field, search input).
4. Trigger integer overflow: When pcre2_compile_32() processes the pattern, the CU2BYTES() multiplication overflows, causing an undersized heap buffer to be allocated.
5. Achieve out-of-bounds write: The compiler writes compiled pattern data beyond the end of the undersized buffer, corrupting adjacent heap memory, potentially enabling further exploitation such as arbitrary code execution (GitHub Advisory).

Upgrade PCRE2 to version 10.48 or later, which adds bounds checks and hardened arithmetic throughout the affected compilation paths to prevent the overflow (PCRE2 Release). If immediate patching is not possible, the primary workaround is to avoid compiling untrusted or attacker-controlled patterns using the 32-bit PCRE2 library in a 32-bit process. Additionally, restricting network access to applications that expose regex compilation functionality can reduce the attack surface. SUSE has released a security update (SUSE-SU-2026:4201-1) addressing this and related PCRE2 vulnerabilities (Red Hat).

Red Hat, SUSE, and Microsoft have all acknowledged the vulnerability and issued advisories or updates. SUSE released security update SUSE-SU-2026:4201-1 addressing multiple PCRE2 issues including CVE-2026-89158. The OSS-Fuzz project was credited with discovering the vulnerability, highlighting the continued value of automated fuzzing for open-source library security (PCRE2 Release, Red Hat).