EUVD-2026-71830
GHSA-cq7w-3xjv-g47g
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
XML regexp parsing inputs routinely originate from network-supplied documents, justifying AV:N over AV:L; AC:H retained for the specific character-group pattern requirement; C:N and I:N per fix semantics and vendor assignment.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
6DescriptionCVE.org
In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.
AnalysisAI
Out-of-bounds read in libxml2's XML regular expression parser exposes all versions before 2.15.4 to a limited availability impact when processing malformed character group patterns. The NXT(index) macro in xmlregexp.c performed a direct array dereference without verifying the index stays within the parsed string's length, allowing a specially crafted regexp pattern to read one byte past the allocated buffer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application pass an untrusted XML Schema or XML document containing a regex pattern with a specifically malformed character group to libxml2's regexp parser (xmlFAParsePosCharGroup in xmlregexp.c). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The reporter-assigned CVSS 3.1 score of 2.9 (Low) reflects AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade libxml2 to version 2.15.4 or later, which contains commit 76fe08d97de88bfaef2f7d5cd27f11954cc5bee2 (https://github.com/GNOME/libxml2/commit/76fe08d97de88bfaef2f7d5cd27f11954cc5bee2) introducing the NXT bounds guard. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stack-based buffer overflow in libxml2's xmlBuildQName function allows remote unauthenticated attackers to crash affecte
xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS befor
The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer
Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X b
Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9
A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. Rated high severity (CVSS 7.5), this vulnerabil
The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denia
parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities. Rated high severity (CVSS 7.
The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial
Multiple use-after-free vulnerabilities in libxml2 2.9.0 and possibly other versions might allow context-dependent attac
The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS befo
The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 1
Same weakness CWE-125 – Out-of-bounds Read
View allShare
External POC / Exploit Code
Leaving vuln.today