CVE-2026-86141
published 2026-09-05CVE-2026-86141: xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length…
PriorityP410low3.3CVSS 3.1
AVLACLPRLUINSUCNINAL
EPSS
0.17%
5.5th percentile
xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| xmlsoft | libxml2 | < 2.15.4 | 2.15.4 |
| xmlsoft | libxml2 | — | — |
CVSS provenance
nvdv3.13.3LOWCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
vendor_redhat2.9LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
xmlsoft libxml2 up to 2.15.3 xmlregexp xmlRegNewParserCtxt null pointer dereference (Nessus ID 343096)
vuldb·2026-09-05·CVSS 2.9
CVE-2026-86141 [LOW] xmlsoft libxml2 up to 2.15.3 xmlregexp xmlRegNewParserCtxt null pointer dereference (Nessus ID 343096)
A vulnerability has been found in xmlsoft libxml2 up to 2.15.3 and classified as critical. Affected by this issue is the function xmlRegNewParserCtxt of the component xmlregexp. Performing a manipulation results in null pointer dereference.
This vulnerability was named CVE-2026-86141. The attack may be initiated remotely. There is no available exploit.
The affected component should be upgraded.
GHSA
xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.
ghsa_unreviewed·2026-09-05
CVE-2026-86141 [LOW] CWE-252 xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.
xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.
Red Hat
libxml2: libxml2: Denial of Service due to NULL pointer dereference in xmlRegNewParserCtxt
vendor_redhat·2026-09-05·CVSS 2.9
CVE-2026-86141 [LOW] CWE-476 libxml2: libxml2: Denial of Service due to NULL pointer dereference in xmlRegNewParserCtxt
libxml2: libxml2: Denial of Service due to NULL pointer dereference in xmlRegNewParserCtxt
A flaw was found in libxml2. A NULL pointer dereference vulnerability exists in the `xmlRegNewParserCtxt` function within the `xmlregexp` component. This occurs because the `strlen()` function is called on a potentially NULL pointer, `ret->string`, before a check for a failed memory allocation by `xmlStrdup()`. A local attacker could exploit this by triggering an `xmlStrdup` failure, leading to a denial of service (DoS) due to a process crash.
Package: libxml2 (Red Hat Hardened Images) - Affected
Package: swift-lang (Red Hat Hardened Images) - Affected
No detection rules found.
No public exploits indexed.
2026-09-05
Published