CVE-2026-86142
published 2026-09-05CVE-2026-86142: In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
PriorityP336medium6.9CVSS 3.1
AVLACHPRNUINSUCHIHAL
EPSS
0.13%
3.1th percentile
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| xmlsoft | libxml2 | < 2.15.4 | 2.15.4 |
| xmlsoft | libxml2 | — | — |
CVSS provenance
nvdv3.16.9MEDIUMCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
vendor_redhat6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
xmlsoft libxml2 up to 2.15.3 xmlXPtrEvalXPtrPart buffer overflow (Nessus ID 343102)
vuldb·2026-09-05·CVSS 6.9
CVE-2026-86142 [MEDIUM] xmlsoft libxml2 up to 2.15.3 xmlXPtrEvalXPtrPart buffer overflow (Nessus ID 343102)
A vulnerability was found in xmlsoft libxml2 up to 2.15.3 and classified as problematic. This affects the function xmlXPtrEvalXPtrPart. Executing a manipulation can lead to buffer overflow.
The identification of this vulnerability is CVE-2026-86142. The attack can only be executed locally. There is no exploit available.
It is suggested to upgrade the affected component.
GHSA
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
ghsa_unreviewed·2026-09-05
CVE-2026-86142 [MEDIUM] CWE-122 In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
Red Hat
libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation
vendor_redhat·2026-09-05·CVSS 6.9
CVE-2026-86142 [MEDIUM] CWE-805 libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation
libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation
A flaw was found in libxml2. A local attacker could exploit a heap-based buffer overflow in the `xmlXPtrEvalXPtrPart` function. This vulnerability occurs due to an integer overflow when processing an oversized `xpointer()` expression, leading to incorrect memory allocation and an out-of-bounds write. Successful exploitation could result in information disclosure, data corruption, or a denial of service.
Package: libxml2 (Red Hat Hardened Images) - Affected
Package: swift-lang (Red Hat Hardened Images) - Affected
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-86142 mingw-libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation [fedora-all]
bugzilla·2026-09-08·CVSS 6.9
CVE-2026-86142 [MEDIUM] CVE-2026-86142 mingw-libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation [fedora-all]
CVE-2026-86142 mingw-libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
Bugzilla
CVE-2026-86142 mingw-libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation [epel-all]
bugzilla·2026-09-08·CVSS 6.9
CVE-2026-86142 [MEDIUM] CVE-2026-86142 mingw-libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation [epel-all]
CVE-2026-86142 mingw-libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
Bugzilla
CVE-2026-86142 libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation [fedora-all]
bugzilla·2026-09-08·CVSS 6.9
CVE-2026-86142 [MEDIUM] CVE-2026-86142 libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation [fedora-all]
CVE-2026-86142 libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
Bugzilla
CVE-2026-86142 libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation
bugzilla·2026-09-05·CVSS 6.9
CVE-2026-86142 [MEDIUM] CVE-2026-86142 libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation
CVE-2026-86142 libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
2026-09-05
Published