EUVD-2026-71834
GHSA-7g6w-jj32-qj92
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Local vector and high complexity because OOM strdup failure must be induced; no C/I impact, only process crash.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.
AnalysisAI
NULL pointer dereference in libxml2's xmlRegNewParserCtxt() function crashes any application invoking the XML regular-expression engine under memory-pressure conditions. Versions before 2.15.4 call strlen() on the return value of xmlStrdup() without first verifying the pointer is non-NULL; when strdup() fails due to memory exhaustion, the subsequent strlen(NULL) causes a process crash. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the target application must invoke libxml2's regexp subsystem (xmlRegNewParserCtxt via xmlregexp.c) - applications that parse XML but never process XML Schema regular expressions are unaffected; (2) a strdup/malloc failure must occur at the exact moment of the xmlStrdup() call inside xmlRegNewParserCtxt(), requiring the process or system to be in an out-of-memory state; and (3) attack vector is local (AV:L), so the attacker must be able to influence the memory state of the host system. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is very low despite libxml2's ubiquitous deployment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade libxml2 to version 2.15.4 or later; the fix is confirmed in upstream commit e89a8aae4c9b40cdafcf66b3f9e57c62db37bb55 (https://github.com/GNOME/libxml2/commit/e89a8aae4c9b40cdafcf66b3f9e57c62db37bb55). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stack-based buffer overflow in libxml2's xmlBuildQName function allows remote unauthenticated attackers to crash affecte
xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS befor
The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer
Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X b
Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9
A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. Rated high severity (CVSS 7.5), this vulnerabil
The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denia
parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities. Rated high severity (CVSS 7.
The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial
Multiple use-after-free vulnerabilities in libxml2 2.9.0 and possibly other versions might allow context-dependent attac
The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS befo
The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 1
Same weakness CWE-252 – Unchecked Return Value
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today