Skip to main content

Libxml2 CVE-2026-86142

| EUVDEUVD-2026-71835 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-09-05 mitre GHSA-499q-6rmh-w6p7
Buffer Overflow Heap Overflow Libxml2 Xmlsoft
7.8
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-122
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Sep 15, 2026

Let me produce the JSON.

Key facts: libxml2 heap buffer overflow in xmlXPtrEvalXPtrPart due to xmlXPtrEval xpointer length saturation. CVSS 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. CWE-122. EPSS 0.13% (3rd percentile). Patch available, fixed in 2.15.4. No KEV, no POC mentioned.

Note: CVSS is local vector, PR:L — so authenticated/local access needed. XPointer evaluation requires parsing untrusted XML/XPointer input. Actually the CVSS says AV:L PR:L which suggests local attacker with low privileges — but libxml2 is typically parsed remotely via XML input. There's a tension: the vector says local. I should note that in risk_assessment — conflicting signal.

Product name: "libxml2" (2 words? it's one word). Fine.

Prevalence: high — libxml2 is widely deployed (core library in many systems). Could argue "ubiquitous". libxml2 is in nearly every Linux distro, used by many apps. I'd say "high" or "ubiquitous". Given anchors: OpenSSL/nginx/Linux kernel = ubiquitous. libxml2 is comparably widespread as a library dependency. I'll say "ubiquitous"? Hmm. It's a core XML parsing library used by GNOME, PHP, Python lxml, many. I'd say "high" to be safe... Actually libxml2 is extremely pervasive. But prevalence is deployment footprint in production. I'll go with "high" with basis "ubiquitous XML parser library across Linux distributions and apps". Hmm, "ubiquitous" anchor is OpenSSL/nginx/kernel. libxml2 is arguably in that class. I'll choose "high" — widely deployed but often not directly network-exposed. Let me pick "high".

Actually let me reconsider: libxml2 is bundled in virtually every Linux distro, used by PHP, Python, Ruby, GNOME, etc. That's arguably closer to ubiquitous. But the anchor "high" = widely-deployed enterprise software. I'll go with "high" and basis "core XML parser in most Linux distributions and many apps".

Hmm, either is defensible. I'll say "high".

assessed_cvss_vector: The vulnerability requires evaluating an XPointer with hostile input. Root cause: len

Earlier versions of this analysis (1)
v1 Sep 05, 2026 - 04:59 CVSS 6.9

Heap-based buffer overflow in libxml2 before 2.15.4 allows arbitrary code execution via a crafted XML document containing an excessively long XPointer expression. The root cause is integer length saturation in xmlStrlen within xmlXPtrEvalXPtrPart: when the XPointer string length overflows to zero, the subsequent heap allocation is undersized, enabling a controlled write beyond the buffer boundary. Any application using libxml2's XPointer evaluation on attacker-influenced XML is affected. No public exploit is identified at time of analysis, though a vendor-confirmed patch (v2.15.4) is available with a corresponding commit diff.

Affected VersionsENISA

libxml2 0 <2.15.4

Affected Packages

euvd libxml2 fix: 2.15.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Libxml2 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mitre) PRIMARY MEDIUM
NVD 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 6.9 MEDIUM

Local vector confirmed by file-processing attack path; AC:H reflects precise integer saturation boundary; C:H/I:H for heap overflow code execution potential; A:L for likely process-level crash only.

3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
4.0 AV:L/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
SUSE 6.9 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Red Hat 6.9 MEDIUM

Primary rating from Vendor (mitre).

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Updated
Sep 15, 2026 - 19:42 vuln.today
v2 - CVSS changed
Severity Changed
Sep 15, 2026 - 19:37 NVD
MEDIUM HIGH
CVSS changed
Sep 15, 2026 - 19:37 NVD
6.9 (MEDIUM) 7.8 (HIGH)
Patch available
Sep 05, 2026 - 06:01 EUVD
CVE Published
Sep 05, 2026 - 04:29 cve.org
MEDIUM 6.9

DescriptionNVD

In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.

Threat Intelligence Overview

EPSS Score
0.1%
Top 97% exploitable
Data Quality
7 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

More in Libxml2

View all
CVE-2025-6021 HIGH POC
7.5 Jun 12

Stack-based buffer overflow in libxml2's xmlBuildQName function allows remote unauthenticated attackers to crash affecte
CVE-2016-4658 CRITICAL
9.8 Sep 25

xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS befor
CVE-2016-1762 HIGH POC
8.1 Mar 24

The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer
CVE-2016-1834 HIGH POC
7.8 May 20

Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X b
CVE-2016-1840 HIGH POC
7.8 May 20

Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9
CVE-2024-34459 HIGH POC
7.5

Alpine Linux: libxml2 fixed in 2.12.7-r0
CVE-2022-40303 HIGH
7.5 Nov 23

An issue was discovered in libxml2 before 2.10.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploit
CVE-2017-9047 HIGH POC
7.5 May 18

A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. Rated high severity (CVSS 7.5), this vulnerabil
CVE-2016-4447 HIGH POC
7.5 Jun 09

The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denia
CVE-2017-16932 HIGH
7.5 Nov 23

parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities. Rated high severity (CVSS 7.
CVE-2016-4483 HIGH POC
7.5 Apr 11

The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial

CVE-2013-1969 HIGH POC
7.5 Apr 25

Multiple use-after-free vulnerabilities in libxml2 2.9.0 and possibly other versions might allow context-dependent attac

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2026-94127 CRITICAL POC
9.3
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:64463 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-86142 ADVISORY https://seclists.org/oss-sec/2026/q3/657 ADVISORY https://ubuntu.com/security/notices/USN-8910-1 ADVISORY https://vuldb.com/vuln/399215 REF https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58 REF https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4 REF https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy