EUVD-2026-71822
GHSA-r2q6-6v35-773j
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
AV:L and AC:H because INT_MAX-scale output buffers are impractical without local/controlled large documents; C:H/I:H reflect callback-level memory corruption; A:L for incidental crash risk.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.
AnalysisAI
Integer overflow in libxml2 before 2.15.4 passes negative-length values into application-level XML write callbacks when output buffer sizes reach or exceed INT_MAX, enabling out-of-bounds memory reads or writes within any callback that trusts the supplied length parameter. The root cause is a type mismatch: xmlBufUse() returns size_t, but xmlOutputWriteCallback expects int - without an overflow guard, buffers of sufficient size silently wrap to negative values. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) an application that uses libxml2's output buffering API (xmlOutputBufferWrite or xmlOutputBufferFlush) with a custom write callback; (2) the XML output data flowing through that buffer must accumulate to >= INT_MAX bytes (approximately 2 GB) in a single output operation, which is uncommon in production workloads; (3) the write callback must use the length parameter in a memory-unsafe way (e.g., as a size for memcpy without re-validation). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 6.9 (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L) is internally coherent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade libxml2 to version 2.15.4 or later; this is confirmed by the upstream tag comparison at https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stack-based buffer overflow in libxml2's xmlBuildQName function allows remote unauthenticated attackers to crash affecte
xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS befor
The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer
Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X b
Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9
A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. Rated high severity (CVSS 7.5), this vulnerabil
The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denia
parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities. Rated high severity (CVSS 7.
The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial
Multiple use-after-free vulnerabilities in libxml2 2.9.0 and possibly other versions might allow context-dependent attac
The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS befo
The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 1
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today