PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
PCRE2 before version 10.48 contains a critical out-of-bounds write vulnerability in its DFA (Deterministic Finite Automaton) matching engine. The flaw occurs when a cached workspace block is reused during recursive pattern matching without proper size validation, despite newly allocated blocks undergoing such checks. This creates a memory safety issue that can be triggered through attacker-controlled regular expressions or recursive patterns, particularly when heap limits are constrained via API configuration. Organizations using PCRE2 for regex processing—including web servers, text processing tools, and security scanning applications—face potential code execution risks if they accept untrusted regex patterns or process user-supplied input against such patterns.
While this CVE currently lacks mapped MITRE ATT&CK techniques and has no confirmed active exploitation, Casky's security skills powered by Claude AI with extended reasoning would focus detection on memory corruption patterns and unsafe resource reuse. Practitioners using Casky would identify attack vectors through behavioral analysis of regex engine interactions: detection of recursive pattern compilation chains, workspace allocation/reuse mismatches, and heap memory pressure indicators. The platform's 754-skill mapping would correlate findings with CWE-424 (Improper Resource Validation) patterns, flagging suspicious regex processing workflows and memory management anomalies. Security teams would see alerts highlighting applications accepting dynamic regex input, unpatched PCRE2 versions, and configurations with artificially constrained memory limits—all preconditions for exploitation.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-86145. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation