SB2026090826 - Multiple vulnerabilities in libxml2

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026090826

SB2026090826 - Multiple vulnerabilities in libxml2

Published: September 8, 2026

Security Bulletin ID SB2026090826
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Partial DoS

Breakdown by Severity

Medium 88% Low 13%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 vulnerabilities.


1) Out-of-bounds read (CVE-ID: CVE-2026-86137)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the NXT macro in xmlregexp when processing input. A remote attacker can provide crafted input to cause a denial of service.


2) Heap-based buffer overflow (CVE-ID: CVE-2026-86138)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer overflow and resultant heap-based buffer overflow in xmlDictAddQString in dict.c when processing input. A remote attacker can provide crafted input to cause a denial of service.


3) Integer overflow (CVE-ID: CVE-2026-86139)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause an integer overflow.

The vulnerability exists due to an integer overflow in xmlURIEscapeStr in uri.c when processing input. A remote attacker can provide crafted input to cause an integer overflow.


4) Stack-based buffer overflow (CVE-ID: CVE-2026-86140)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in xmlSnprintfElements in valid.c when processing input. A remote attacker can provide crafted input to cause a denial of service.


5) NULL pointer dereference (CVE-ID: CVE-2026-86141)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in xmlRegNewParserCtxt in xmlregexp when a strdup failure occurs. A remote attacker can trigger parser-context creation to cause a denial of service.

Exploitation requires a strdup failure.


6) Heap-based buffer overflow (CVE-ID: CVE-2026-86142)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in xmlXPtrEvalXPtrPart when processing XPointer input. A remote attacker can provide crafted XPointer input to cause a denial of service.

The overflow is caused by XPointer length saturation in xmlXPtrEval.


7) Integer overflow (CVE-ID: CVE-2026-86143)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause negative lengths to reach write callbacks.

The vulnerability exists due to an integer overflow in xmlOutputWriteCallback and xmlBufUse in xmlIO when invoking write callbacks. A remote attacker can invoke an output write callback to cause negative lengths to reach write callbacks.

The issue is caused by an inconsistency between xmlOutputWriteCallback and xmlBufUse.


8) XML External Entity injection (CVE-ID: CVE-2026-86144)

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper propagation of parse flags in xmlXIncludeProcess and xmlXIncludeProcessTree in xinclude when processing XInclude content. A remote attacker can supply an XInclude document that references an attacker-controlled internet resource to cause a denial of service.

The issue is relevant when a custom resource loader can access the internet and the XML_PARSE_NONET flag is not propagated.


Remediation

Install update from vendor's website.

References