PCRE2 version 10.49 is a security-only release. It fixes an out-of-bounds write with arbitrary data under specific JIT usage conditions.
PCRE2 10.49 was announced on September 28, 2026, as a security-only release addressing the issue identified as GHSA-r9hj-j2rw-4q3m. Compared with version 10.48, the described code change is minimal: it prevents an out-of-bounds write with arbitrary data.
According to the advisory, exploitation requires an attacker-controlled regular expression. Applications are affected only if they use pcre2_jit_stack_create() and pcre2_jit_stack_assign() to provide an expandable JIT stack. Consult the original PCRE2 project advisory and release notes to confirm the scope and assess an update in your environment.