CVE-2026-86137: libxml2 Information Disclosure Vulnerability

CVE-2026-86137 Overview

CVE-2026-86137 is an out-of-bounds read vulnerability in libxml2 versions before 2.15.4. The flaw resides in the xmlFAParsePosCharGroup function within the regular expression parser and is triggered through the NXT macro in xmlregexp.c. When parsing crafted regular expression input, the macro can read memory beyond the bounds of the input buffer. The issue is categorized as [CWE-125] Out-of-Bounds Read and requires local access with high attack complexity to trigger. Impact is limited to availability, with no confidentiality or integrity effects.

Critical Impact
Local attackers supplying crafted regular expression input to applications linked against vulnerable libxml2 builds can trigger out-of-bounds memory reads that may cause process crashes or unexpected behavior.

Affected Products

GNOME libxml2 versions prior to 2.15.4
Applications and libraries that link against affected libxml2 builds
Software distributions that bundle vulnerable libxml2 releases

Discovery Timeline

2026-09-05 - CVE-2026-86137 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86137

Vulnerability Analysis

The vulnerability affects the regular expression compilation code in xmlregexp.c. The parser advances through the input string using pointer arithmetic on ctxt->cur. The NXT(index) macro dereferences ctxt->cur[index] without verifying that the resulting position remains within the bounds of the source string. When xmlFAParsePosCharGroup processes malformed or truncated positive character group syntax, the macro reads past the end of the buffer.

The consequence is a bounded, low-impact information read from adjacent memory, most commonly manifesting as an application crash or undefined parser state. Exploitation requires the attacker to supply regular expression input to a process using libxml2, and the high attack complexity reflects the narrow conditions required to trigger the out-of-bounds access.

Root Cause

The root cause is missing bounds validation in a low-level access macro. NXT(index) computed an index relative to ctxt->cur without comparing the resulting offset against ctxt->len, the length of the original string. Any lookahead performed near the end of the input could therefore read outside the allocated buffer.

Attack Vector

An attacker with local access supplies a crafted XML schema regular expression to an application that uses libxml2 for schema validation or regex compilation. Parsing the malformed pattern causes xmlFAParsePosCharGroup to invoke NXT beyond the input boundary, reading adjacent memory.

     xmlRegexpErrCompile(ctxt, str);
 #define NEXT ctxt->cur++
 #define CUR (*(ctxt->cur))
-#define NXT(index) (ctxt->cur[index])
+#define NXT(index)									\
+    (((size_t)(ctxt->cur + index - ctxt->string) < ctxt->len)				\
+      ? ctxt->cur[index] : 0)
 
 #define NEXTL(l) ctxt->cur += l;
 #define XML_REG_STRING_SEPARATOR '|'
// Source: https://github.com/GNOME/libxml2/commit/76fe08d97de88bfaef2f7d5cd27f11954cc5bee2
// The patch redefines NXT to validate the computed offset against ctxt->len before dereferencing ctxt->cur[index], returning 0 when the access would exceed the input buffer.

Detection Methods for CVE-2026-86137

Indicators of Compromise

Unexpected crashes or segmentation faults in processes that parse untrusted XML schemas or regular expressions with libxml2
AddressSanitizer or Valgrind reports referencing xmlFAParsePosCharGroup or the NXT macro in xmlregexp.c
Repeated failures in schema validation workflows that process externally supplied input

Detection Strategies

Inventory installed libxml2 versions across servers, workstations, and container images and flag any build below 2.15.4
Enable memory error detection instrumentation in fuzzing pipelines that exercise XML schema parsing paths
Correlate application crash telemetry with input events that include XML Schema regular expressions

Monitoring Recommendations

Monitor package management logs to confirm libxml2 updates are applied to all impacted hosts
Track process crash and core-dump generation for services that consume untrusted XML input
Alert on repeated abnormal termination of applications known to use libxml2 for regex compilation

How to Mitigate CVE-2026-86137

Immediate Actions Required

Upgrade libxml2 to version 2.15.4 or later on all affected systems
Rebuild and redeploy applications and container images that statically link vulnerable libxml2 versions
Restrict acceptance of untrusted XML schemas and regular expressions in services that cannot be patched immediately

Patch Information

The fix is included in libxml2 2.15.4. Commit 76fe08d97de88bfaef2f7d5cd27f11954cc5bee2 modifies the NXT macro to verify that the computed index remains within ctxt->len before dereferencing. Review the GitHub commit details, the GitHub version comparison for v2.15.3 to v2.15.4, and the GNOME GitLab work item #1099 for full context.

Workarounds

Disable or restrict XML schema regular expression processing in applications that expose this functionality to untrusted local users
Run parsers that consume untrusted input in isolated processes or sandboxes to contain crash-based impact
Apply input filters that reject malformed XML Schema regex constructs before invoking libxml2

bash

# Verify installed libxml2 version and update on Debian-based systems
dpkg -s libxml2 | grep -i version
sudo apt-get update && sudo apt-get install --only-upgrade libxml2

# Verify installed libxml2 version and update on RHEL-based systems
rpm -q libxml2
sudo dnf update libxml2