Skip to main content

Libxml2 CVE-2026-86138

| EUVDEUVD-2026-71831 HIGH
Integer Overflow or Wraparound (CWE-190)
2026-09-05 mitre GHSA-v4gg-2cxp-fc23
Buffer Overflow Integer Overflow Libxml2 Xmlsoft
7.8
CVSS 3.1 · NVD
Temporal: 6.9
View

Vulnerability Assessment

Weakness
CWE
CWE-190
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Sep 15, 2026

Heap-based buffer overflow in libxml2 before 2.15.4, reachable through the internal dictionary routine xmlDictAddQString() in dict.c, which miscalculates the size of an exponentially growing string pool and can be driven past the integer range before allocating. Per the vendor-assigned CVSS vector the attack is local with low privileges (AV:L/PR:L), so it primarily affects applications, daemons, or sandboxed services that parse attacker-influenced XML under a constrained account. A vendor patch (2.15.4, commit a4cba4b5) and a Red Hat errata exist, but there is no CISA KEV listing and no confirmed public exploit — EPSS is only 0.12% (2nd percentile), so this is a patch-hygiene item rather than a fire drill.

Earlier versions of this analysis (1)
v1 Sep 05, 2026 - 04:43 CVSS 6.9

Heap-based buffer overflow in libxml2 before 2.15.4 allows an attacker who can supply maliciously crafted XML with oversized namespace-qualified names to corrupt heap memory within any application linking against the library, potentially enabling code execution or sensitive memory disclosure. The root cause is an integer overflow in xmlDictAddQString (dict.c) during dictionary string-pool growth, where unchecked multiplication and addition of the buffer size and string lengths could wrap around, producing an undersized heap allocation subsequently overwritten with full-length data. No public exploit code or CISA KEV listing is present at time of analysis, though the pervasive embedding of libxml2 across OS stacks, language runtimes, and application middleware substantially widens the potential attack surface.

Affected VersionsENISA

libxml2 0 <2.15.4

Affected Packages

euvd libxml2 fix: 2.15.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Libxml2 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mitre) PRIMARY MEDIUM
NVD 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CIRCL (temporal) 6.9 MEDIUM
vuln.today AI 7.7 HIGH

libxml2 routinely parses network-supplied XML in practice, warranting AV:N; AC:H reflects heap-grooming requirement for controlled exploitation beyond crash.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
SUSE 6.9 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Red Hat 6.9 MEDIUM

Primary rating from Vendor (mitre).

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Updated
Sep 15, 2026 - 19:57 vuln.today
v2 - CVSS changed
Severity Changed
Sep 15, 2026 - 19:52 NVD
MEDIUM HIGH
CVSS changed
Sep 15, 2026 - 19:52 NVD
6.9 (MEDIUM) 7.8 (HIGH)
Patch available
Sep 05, 2026 - 06:01 EUVD
CVE Published
Sep 05, 2026 - 04:21 cve.org
MEDIUM 6.9

DescriptionNVD

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.

Threat Intelligence Overview

EPSS Score
0.1%
Top 98% exploitable
Data Quality
7 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

More in Libxml2

View all
CVE-2025-6021 HIGH POC
7.5 Jun 12

Stack-based buffer overflow in libxml2's xmlBuildQName function allows remote unauthenticated attackers to crash affecte
CVE-2016-4658 CRITICAL
9.8 Sep 25

xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS befor
CVE-2016-1762 HIGH POC
8.1 Mar 24

The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer
CVE-2016-1834 HIGH POC
7.8 May 20

Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X b
CVE-2016-1840 HIGH POC
7.8 May 20

Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9
CVE-2024-34459 HIGH POC
7.5

Alpine Linux: libxml2 fixed in 2.12.7-r0
CVE-2022-40303 HIGH
7.5 Nov 23

An issue was discovered in libxml2 before 2.10.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploit
CVE-2017-9047 HIGH POC
7.5 May 18

A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. Rated high severity (CVSS 7.5), this vulnerabil
CVE-2016-4447 HIGH POC
7.5 Jun 09

The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denia
CVE-2017-16932 HIGH
7.5 Nov 23

parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities. Rated high severity (CVSS 7.
CVE-2016-4483 HIGH POC
7.5 Apr 11

The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial

CVE-2013-1969 HIGH POC
7.5 Apr 25

Multiple use-after-free vulnerabilities in libxml2 2.9.0 and possibly other versions might allow context-dependent attac

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2026-97229 CRITICAL POC
10.0
CVE-2017-7529 HIGH
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:64463 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-86138 ADVISORY https://seclists.org/oss-sec/2026/q3/657 ADVISORY https://ubuntu.com/security/notices/USN-8910-1 ADVISORY https://vuldb.com/vuln/399209 REF https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4 REF https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy