libxml2 CVE-2026-11979

Exploitation requires that the attacker or victim explicitly invoke the xmlcatalog utility with the --shell flag to enter interactive shell mode - this is a non-default, non-automated invocation that is not triggered during any normal XML processing workflow or library API call. Local system access is required (AV:L per CVSS 4.0); the vulnerability cannot be triggered remotely. Active user interaction is required (UI:A per CVSS 4.0): a user must deliberately run xmlcatalog in shell mode and supply the malicious input, making self-exploitation or social engineering the realistic attack path. An attack precondition must be met (AT:P): the xmlcatalog binary must be installed, accessible, and actively used in --shell mode. The overflow is bounded to the xmlcatalog process and does not affect libxml2 when used as a shared library by other applications. Primary limiting factors are: mandatory local access, non-default interactive invocation mode, required user-initiated action, and modern stack protections (SSP/ASLR) that impede reliable code execution beyond a crash.

The CVSS 4.0 score of 1.8 (AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N) places this at the lowest practical severity tier. Attack Vector is Local, requiring authenticated shell access to the host; there is no remote attack path. User Interaction is Active (UI:A), meaning a user must deliberately invoke xmlcatalog with the --shell flag - not an incidental or automated action. The Attack Prerequisites flag (AT:P) further acknowledges that this interactive mode must be in use. No EPSS score was provided in the available intelligence; the CVE is absent from CISA KEV, confirming no known active exploitation. No public proof-of-concept code has been identified. The 'RCE' tag reflects the theoretical worst case - control-flow hijack via stack corruption - but practical exploitation against hardened modern systems is unlikely, with a process crash being the realistic outcome. The maintainers' explicit position that this is a bug rather than a vulnerability further deprioritizes urgency. The overall signal set consistently indicates a narrow, low-risk issue with a minimal real-world attack surface.

A local user on a Linux system runs xmlcatalog with the --shell flag to enter interactive mode, then supplies or pipes an excessively long input string, overflowing the fixed-size command/arg/argv buffers in usershell() and corrupting the stack frame. On systems without effective stack canaries or with exploitable memory layouts, this could permit a ROP-chain or shellcode execution within the xmlcatalog process context; on hardened systems, the realistic outcome is a process crash. No public exploit code has been identified at time of analysis.