## This update for pcre2 fixes the following issues: * CVE-2026-86145: missing size checks in `pcre2_dfa_match` code can lead to an out-of-bounds write (bsc#1279893). * CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback (bsc#1280054). * CVE-2026-89157: out-of-bounds write via large pattern input (bsc#1280053). * CVE-2026-89158: out-of-bounds write due to integer overflow in `pcre2_compile_32` for 32-bit platforms (bsc#1280052). * CVE-2026-89160: out-of-bounds read during the `PCRE2_MATCH_INVALID_UTF` matching of an invalid UTF subject (bsc#1280051). * CVE-2026-89161: incorrect free operation due to mishandling of a previously copied subject in `pcre2_jit_match` (bsc#1280050). ## Patch Instructions:

* bsc#1277707

* bsc#1277708

* bsc#1277709

* bsc#1277710

* bsc#1277711

* bsc#1277713

* bsc#1279893

* bsc#1280050

* bsc#1280051

* bsc#1280052

* bsc#1280053

* bsc#1280054

Cross-

* CVE-2026-86145

* CVE-2026-89156

* CVE-2026-89157

* CVE-2026-89158

* CVE-2026-89160

* CVE-2026-89161

CVSS scores:

* CVE-2026-86145 ( SUSE ): 8.3

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

* CVE-2026-86145 ( SUSE ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

* CVE-2026-86145 ( NVD ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

* CVE-2026-89156 ( SUSE ): 8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

* CVE-2026-89156 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H