CVE-2026-103111

HighCVSS 7.6/10Last modified Oct 4, 2026

Description

PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Weakness enumeration

CWE-787

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
PCREPCRE2< 10.49

References

Timeline

Published
Sep 30, 2026
Last modified
Oct 4, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1031127.5A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system CVE-2026-1031134.7A vulnerability was determined in OS4ED openSIS-Classic up to 9.3. The affected element is the function save action of the file modules/studCVE-2026-1031146.3A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the function DBQuery_assignment of the file modulCVE-2026-1031156.3A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file functions/CustomFieldsFCVE-2026-1031166.3A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.phpCVE-2026-1031174.7A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db_properties of the file functions/CVE-2026-1031184.3A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coCVE-2026-1031199.1Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split betweenCVE-2026-10324.3The Conditional Menus plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.6. This is CVE-2026-1032204.5The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing raster image datCVE-2026-1032225.6A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file blosc/blosclz.c of thCVE-2026-1032235.9In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-
CVE-2026-103111: High severity, CVSS 7.6 | Vulnix