CVE-2026-103111

A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time (JIT) compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt memory, or cause a denial of service (DoS).

This vulnerability is rated as an Important impact because applications that compile untrusted regular expressions using PCRE2 Just-In-Time (JIT) execution interfaces may allow memory corruption and arbitrary code execution. The risk is primarily confined to specific custom applications or specialized network services that process external regular expressions using vulnerable JIT routines.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.