CVE-2026-11979: Xmlsoft Libxml2 Buffer Overflow Vulnerability

CVE-2026-11979 Overview

CVE-2026-11979 affects libxml2, a widely deployed XML parsing library maintained by the GNOME project. The vulnerability resides in the xmlcatalog utility when executed in --shell mode. The usershell() function processes user input using fixed-size stack buffers without bounds checking. An attacker who supplies an overly long input line can overflow the internal command, arg, and argv buffers during parsing, corrupting the stack frame. Successful exploitation may cause the process to crash or potentially permit arbitrary code execution in the context of the xmlcatalog process. The libxml2 maintainers classified this issue as a bug rather than a security vulnerability. The flaw is tracked as a stack-based buffer overflow [CWE-121].

Critical Impact
Local attackers who can supply crafted input to the xmlcatalog --shell interactive session can corrupt stack memory, causing crashes or potential arbitrary code execution in the utility's process context.

Affected Products

xmlsoft libxml2 (prior to commit c2e233fc)
The xmlcatalog utility shipped with libxml2 when invoked with --shell
Downstream Linux distributions packaging vulnerable libxml2 versions

Discovery Timeline

2026-06-29 - CVE-2026-11979 published to NVD
2026-06-30 - Last updated in NVD database
Fix commit - GNOME libxml2 commit c2e233fc addresses the overflow

Technical Details for CVE-2026-11979

Vulnerability Analysis

The defect exists in the usershell() function inside the xmlcatalog utility. This function implements the interactive shell that runs when a user invokes xmlcatalog --shell. It reads an input line and parses it into a command token, an argument token, and an argv array using fixed-size stack buffers.

Because the parser does not validate the length of tokens against the destination buffer sizes, an attacker who can direct input to the shell can write past the end of these buffers. The overwrite occurs on the stack frame of usershell(), corrupting adjacent local variables, saved registers, and potentially the saved return address.

The impact is scoped to local exploitation since xmlcatalog --shell reads from standard input and is not a network-facing service. In environments where xmlcatalog is invoked programmatically against attacker-influenced catalog input, the consequences extend beyond an interactive user crash.

Root Cause

The root cause is the use of unbounded string copy operations against fixed-size stack allocations for the command, arg, and argv variables within usershell(). No length checks are performed before writing parsed tokens into these buffers, satisfying the classic stack-based buffer overflow pattern described in [CWE-121].

Attack Vector

Exploitation requires local access and user interaction to feed a crafted line into the xmlcatalog --shell session. An attacker supplies an input line where one or more tokens exceed the destination buffer size. Parsing then writes attacker-controlled bytes onto the stack. Depending on compiler mitigations such as stack canaries, ASLR, and non-executable stacks, the outcome ranges from process termination to arbitrary code execution within the privilege context of the xmlcatalog process.

The vulnerability mechanism is described in the CERT.pl advisory for CVE-2026-11979 and the corresponding GNOME libxml2 fix commit c2e233fc.

Detection Methods for CVE-2026-11979

Indicators of Compromise

Unexpected crashes, segmentation faults, or core dumps produced by the xmlcatalog binary.
Shell sessions or automation logs invoking xmlcatalog --shell with unusually long input lines.
Presence of libxml2 versions predating the upstream fix commit c2e233fc on production systems.

Detection Strategies

Inventory installed libxml2 package versions across Linux hosts and compare against distribution advisories that incorporate commit c2e233fc.
Audit shell history and job schedulers for scripts that pipe untrusted input into xmlcatalog --shell.
Monitor for abnormal termination signals (SIGSEGV, SIGABRT) associated with the xmlcatalog process.

Monitoring Recommendations

Enable core dump collection and crash telemetry on build servers and developer workstations that use xmlcatalog.
Alert on invocations of xmlcatalog --shell outside of expected maintenance windows.
Track process creation events with command-line arguments containing --shell for the xmlcatalog binary.

How to Mitigate CVE-2026-11979

Immediate Actions Required

Upgrade libxml2 to a build that includes upstream commit c2e233fc or a downstream package with the equivalent patch.
Avoid running xmlcatalog --shell against untrusted or attacker-influenced input streams.
Restrict local access to systems where xmlcatalog is installed to trusted users only.

Patch Information

The issue is fixed in GNOME libxml2 commit c2e233fc1b341685fc99621b2768b503f777a72e. Refer to the GNOME libxml2 patch commit for the exact source changes. Rebuild any statically linked applications against the patched library, and apply updated distribution packages once they publish releases containing this commit.

Workarounds

Do not invoke xmlcatalog with the --shell flag; use non-interactive xmlcatalog operations that accept parameters directly on the command line.
Wrap any required interactive use in a controlled environment that truncates input lines to a safe length before feeding them into the utility.
Remove the xmlcatalog binary from hosts where it is not required for XML catalog administration.

bash

# Confirm the installed libxml2 version and locate xmlcatalog
xmlcatalog --version
which xmlcatalog

# On Debian/Ubuntu, update libxml2 utilities
sudo apt-get update && sudo apt-get install --only-upgrade libxml2 libxml2-utils

# On RHEL/Fedora, update libxml2
sudo dnf update libxml2

# Restrict execution to trusted administrators as a hardening measure
sudo chmod 750 $(which xmlcatalog)