PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).

A vulnerability in PCRE2 before version 10.48 allows an out-of-bounds write via the pcre2_dfa_match function. The flaw stems from the reuse of a cached workspace block in a recursive DFA matching context without performing a size check, unlike newly allocated blocks which do include such a check. An attacker can exploit this by supplying a crafted regular expression or by leveraging a recursive pattern combined with a small heap limit, which can be configured through the PCRE2 API. The vulnerability may lead to memory corruption, potentially enabling code execution or denial of service. It has been patched in PCRE2 version 10.48. The issue is tracked under CVE-2026-86145 and a GitHub security advisory has been published by the PCRE2 Project.