CVE-2016-3191: The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 1...

Security readout for executives and security teams

CVE-2016-3191 is a flaw in the PCRE regular expression compiler. A specially crafted regular expression can corrupt stack memory when affected PCRE/PCRE2 versions parse it. Systems are most at risk when they compile regex patterns supplied by users, files, mail, scripts, or web content. Impact can include crash or arbitrary code execution. Exposure depends on whether software uses vulnerable PCRE/PCRE2 and compiles attacker-controlled regular expressions. The source bundle cites Konqueror JavaScript RegExp handling as a demonstration and includes vendor references from Red Hat, Debian, Oracle, IBM, Blue Coat, Tenable, and Exim. Prioritize remediation where internet-facing or content-processing systems compile untrusted regular expressions. Business urgency is lower for systems using PCRE only with trusted, static patterns, but inventory is important because PCRE is widely embedded. Mitigation focus: Upgrade PCRE to 8.39 or later where PCRE 8.x is used.; Upgrade PCRE2 to 10.22 or later where PCRE2 is used.; Apply relevant vendor security updates from affected operating system or product suppliers..

Prepared

Jun 13, 2026, 21:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.