libxml2 CVE-2026-86141

Exploitation requires three concurrent conditions: (1) the target application must invoke libxml2's regexp subsystem (xmlRegNewParserCtxt via xmlregexp.c) - applications that parse XML but never process XML Schema regular expressions are unaffected; (2) a strdup/malloc failure must occur at the exact moment of the xmlStrdup() call inside xmlRegNewParserCtxt(), requiring the process or system to be in an out-of-memory state; and (3) attack vector is local (AV:L), so the attacker must be able to influence the memory state of the host system. No network-reachable exploitation path is described. The vulnerability does not trigger under normal memory conditions, substantially limiting exploitability beyond edge-case resource-exhaustion scenarios.

Real-world risk is very low despite libxml2's ubiquitous deployment. The CVSS 3.1 vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L correctly reflects the key constraints: attack vector is local (AV:L) and complexity is high (AC:H) because triggering the flaw requires inducing a strdup/malloc failure - an OOM condition - at precisely the moment xmlRegNewParserCtxt() is executing. This is not remotely exploitable unless the calling application exposes XML regex processing directly to network input AND is simultaneously under attacker-controlled memory pressure, an exceptionally narrow scenario. Impact is limited to A:L (process crash), with no confidentiality or integrity consequences. No KEV listing, no public POC, and EPSS is not provided but expected to be negligibly low for this class of issue. The CVSS base score of 2.9 is consistent with the realistic threat model. Priority for patching is low except in environments where libxml2 processes untrusted regex patterns in long-running, memory-constrained daemons.

An attacker with local access to a system running a memory-constrained application that uses libxml2's regexp engine (such as a document parser or XML schema validator) artificially exhausts available heap memory, then causes the application to parse an XML schema containing a regular expression. When xmlRegNewParserCtxt() calls xmlStrdup() and malloc returns NULL, the subsequent strlen(NULL) dereferences a null pointer, crashing the process. No public exploit code exists for this scenario.