CVE-2026-103111

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-103111
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103111.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-103111
Aliases
  • GHSA-r9hj-j2rw-4q3m
Downstream
ALPINE (1)
ALSA (4)
AZL (6)
BELL (1)
CLSA (2)
DEBIAN (1)
ECHO (1)
MGASA (1)
OESA (4)
openSUSE (2)
RHSA (13)
RLSA (4)
ROOT (1)
SUSE (2)
UBUNTU (1)
Related
ALSA (4)
openSUSE (2)
SUSE (2)
Published
2026-09-30T04:13:59Z
Modified
2026-11-12T17:29:07Z
Severity
  • 7.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L CVSS Calculator
Summary
[none]
Details

PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.

Database specific 
{
    "cna_assigner": "mitre",
    "cwe_ids": [
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103111.json"
}
References

Affected packages

Git / github.com/pcre2project/pcre2

Affected ranges

Type
GIT
Repo
https://github.com/pcre2project/pcre2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6f9d7c1373262c541324a16a358785b33ef116cf
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "10.49"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "2"
                },
                {
                    "fixed": "10.49"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

Affected versions

pcre2-10.*
pcre2-10.38
pcre2-10.38-RC1
pcre2-10.39
pcre2-10.40
pcre2-10.41
pcre2-10.42
pcre2-10.43
pcre2-10.43-RC1
pcre2-10.44

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103111.json"