libxml2 EUVD-2026-71830

Exploitation requires that the target application pass an untrusted XML Schema or XML document containing a regex pattern with a specifically malformed character group to libxml2's regexp parser (xmlFAParsePosCharGroup in xmlregexp.c). Applications that do not process XML Schema pattern facets or regexp-bearing XML are not exposed to this code path. The CVSS AC:H rating confirms that specific input structure is required to reach the out-of-bounds access - arbitrary XML documents do not trivially trigger it. No authentication is required at the libxml2 library level; however, application-layer access controls may limit who can supply input. Impact is strictly limited to availability (A:L, limited crash/parse failure) - code execution and memory disclosure are not established impacts per vendor CVSS and fix semantics.

The reporter-assigned CVSS 3.1 score of 2.9 (Low) reflects AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L. The local attack vector designation is conservative - in practice, libxml2 is overwhelmingly invoked by server-side applications processing XML content from network sources, and a crafted schema pattern could reach xmlFAParsePosCharGroup through a network-supplied document, effectively raising the practical attack surface beyond what AV:L implies. High complexity (AC:H) is well-supported: the OOB read requires a specifically malformed regexp character group. The sole CVSS impact is A:L (limited availability), consistent with a parse error or process crash rather than code execution or memory disclosure. The fix semantics - returning 0 instead of the OOB byte - reinforce C:N. No EPSS score was provided; no KEV listing and no POC are known. The 'Buffer Overflow' tag in the input metadata is a confirmed mislabel (CWE-125 is an OOB read, not a write-side overflow), and the 'Information Disclosure' tag is unsupported by the CVSS (C:N) and the patch behavior. Overall priority is low: this is a stability concern in a specific regexp parsing path, not an exploitable code-execution or data-theft vector.

An attacker submits a crafted XML Schema or XML document containing a regular expression with a malformed character group to an application that invokes libxml2's xmlFAParsePosCharGroup during pattern-facet validation. As the parser iterates through the character group, the unguarded NXT macro reads one byte past the end of the pattern string, causing a crash or abnormal parse termination. No public proof-of-concept is known at time of analysis, and the limited A:L impact makes weaponization for purposes beyond denial of service implausible.