EUVD-2026-40092
GHSA-h67q-h62w-5mjr
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with no privileges required to run xmlcatalog; user must actively invoke --shell mode (UI:R); impact is limited to process crash (A:L) within the unchanged xmlcatalog process scope.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
1DescriptionCVE.org
libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow internal buffers (command, arg, and argv) during input parsing. This results in memory corruption within the stack frame. Successful exploitation may cause a crash or potentially allow arbitrary code execution in the context of the xmlcatalog process.
This issue has been fixed in the commit c2e233fc.
NOTE: The maintainers of this project did not agree that this issue is a vulnerability and considered it a bug.
AnalysisAI
Stack-based buffer overflows in libxml2's xmlcatalog utility enable memory corruption and potential arbitrary code execution when the tool is invoked in its interactive --shell mode. The usershell() function writes user-supplied input into fixed-size stack buffers (command, arg, argv) without any length validation, allowing overflow of adjacent stack memory including return addresses. Real-world risk is very low: exploitation requires local access, deliberate user invocation of a non-default shell mode, and an attack precondition - reflected in the CVSS 4.0 score of 1.8 - with no public exploit or active exploitation identified. Notably, libxml2 maintainers disputed the security classification, treating this as a bug rather than a vulnerability.
Technical ContextAI
libxml2 (CPE: cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*) is an open-source XML parsing library maintained by the GNOME project and shipped in virtually all Linux and Unix distributions. The affected component is the xmlcatalog command-line utility, specifically its interactive --shell mode implemented in the usershell() function. The root cause is CWE-121 (Stack-based Buffer Overflow): usershell() allocates fixed-size arrays on the call stack to hold parsed command tokens, arguments, and argv entries but performs no bounds checking on input length, so an excessively long input line overwrites adjacent stack memory including saved frame pointers and return addresses. Modern hardening measures - stack canaries (SSP), ASLR, and non-executable stack - raise the practical bar for reliable code execution, but a crash-level denial-of-service against the xmlcatalog process is straightforward to trigger.
RemediationAI
The upstream fix is available as GitLab commit c2e233fc (https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e); a formally tagged patched release version has not been confirmed from available data - monitor the libxml2 GNOME GitLab repository for a tagged release incorporating this commit and apply it once available. As an immediate compensating control, restrict or remove execution permissions on the xmlcatalog binary for unprivileged users (e.g., chmod 750 /usr/bin/xmlcatalog or equivalent), which fully eliminates the attack surface with no impact on the libxml2 library's XML parsing functionality used by other applications and services. Enforcing a policy that prohibits interactive use of xmlcatalog --shell mode in production environments provides additional risk reduction at no operational cost. Note that because the libxml2 maintainers dispute the security classification, downstream Linux distribution maintainers may not backport this fix on an accelerated schedule, requiring manual application from the upstream commit if organizational policy demands earlier remediation.
Stack-based buffer overflow in libxml2's xmlBuildQName function allows remote unauthenticated attackers to crash affecte
xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS befor
The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer
Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X b
Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9
A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. Rated high severity (CVSS 7.5), this vulnerabil
The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denia
parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities. Rated high severity (CVSS 7.
The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial
Multiple use-after-free vulnerabilities in libxml2 2.9.0 and possibly other versions might allow context-dependent attac
The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS befo
The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 1
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today