CVE-2026-86142
published 2026-09-05CVE-2026-86142: In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
PriorityP345high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.16%
4.4th percentile
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ubuntu | libxml2 | — | — |
| xmlsoft | libxml2 | < 2.15.4 | 2.15.4 |
| xmlsoft | libxml2 | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat6.9MEDIUM
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
xmlsoft libxml2 up to 2.15.3 xmlXPtrEvalXPtrPart buffer overflow (Nessus ID 343102)
vuldb·2026-09-05·CVSS 6.9
CVE-2026-86142 [MEDIUM] xmlsoft libxml2 up to 2.15.3 xmlXPtrEvalXPtrPart buffer overflow (Nessus ID 343102)
A vulnerability was found in xmlsoft libxml2 up to 2.15.3 and classified as problematic. This affects the function xmlXPtrEvalXPtrPart. Executing a manipulation can lead to buffer overflow.
The identification of this vulnerability is CVE-2026-86142. The attack can only be executed locally. There is no exploit available.
It is suggested to upgrade the affected component.
GHSA
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
ghsa_unreviewed·2026-09-05
CVE-2026-86142 [MEDIUM] CWE-122 In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
Ubuntu
libxml2 vulnerabilities
vendor_ubuntu·2026-10-08·CVSS 5.5
CVE-2026-86144 [MEDIUM] libxml2 vulnerabilities
Title: libxml2 vulnerabilities
Summary: Several security issues were fixed in libxml2.
Yirou Yang discovered that libxml2 incorrectly handled certain XML
catalogs. If a user or automated system was tricked into processing a
specially crafted XML catalog, an attacker could possibly use this issue to
cause libxml2 to crash, resulting in a denial of service. (CVE-2026-76781)
It was discovered that libxml2 incorrectly handled certain large qualified
names, leading to a heap-based buffer overflow. An attacker could possibly
use this issue to cause libxml2 to crash, resulting in a denial of service,
or possibly execute arbitrary code. (CVE-2026-86138)
It was discovered that libxml2 incorrectly handled escaping certain large
URI strings. An attacker could possibly use this issue to cause libx
Red Hat
libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation
vendor_redhat·2026-09-05·CVSS 6.9
CVE-2026-86142 [MEDIUM] CWE-805 libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation
libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation
A flaw was found in libxml2. A local attacker could exploit a heap-based buffer overflow in the `xmlXPtrEvalXPtrPart` function. This vulnerability occurs due to an integer overflow when processing an oversized `xpointer()` expression, leading to incorrect memory allocation and an out-of-bounds write. Successful exploitation could result in information disclosure, data corruption, or a denial of service.
Package: libxml2 (Red Hat Hardened Images) - Affected
Package: swift-lang (Red Hat Hardened Images) - Affected
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-86142 mingw-libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation [fedora-all]
bugzilla·2026-09-08·CVSS 6.9
CVE-2026-86142 [MEDIUM] CVE-2026-86142 mingw-libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation [fedora-all]
CVE-2026-86142 mingw-libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
Bugzilla
CVE-2026-86142 mingw-libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation [epel-all]
bugzilla·2026-09-08·CVSS 6.9
CVE-2026-86142 [MEDIUM] CVE-2026-86142 mingw-libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation [epel-all]
CVE-2026-86142 mingw-libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
Bugzilla
CVE-2026-86142 libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation [fedora-all]
bugzilla·2026-09-08·CVSS 6.9
CVE-2026-86142 [MEDIUM] CVE-2026-86142 libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation [fedora-all]
CVE-2026-86142 libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
Bugzilla
CVE-2026-86142 libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation
bugzilla·2026-09-05·CVSS 6.9
CVE-2026-86142 [MEDIUM] CVE-2026-86142 libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation
CVE-2026-86142 libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
2026-09-05
Published