CVE-2026-86139: libxml2 Buffer Overflow Vulnerability

CVE-2026-86139 Overview

CVE-2026-86139 is an integer overflow vulnerability [CWE-190] in libxml2 versions before 2.15.4. The flaw resides in the xmlURIEscapeStr function within uri.c, which handles URI escape-string processing. An attacker who can supply crafted input to an application linked against a vulnerable libxml2 build may trigger memory corruption during URI escaping. Because libxml2 is embedded in a broad set of operating systems, browsers, language runtimes, and enterprise applications, the vulnerability has wide downstream reach.

Critical Impact

Integer overflow in xmlURIEscapeStr can lead to undersized memory allocation and subsequent memory corruption when processing attacker-controlled URI strings on local systems.

Affected Products

• libxml2 versions prior to 2.15.4
• Applications and language bindings statically or dynamically linked against vulnerable libxml2 builds
• Linux and BSD distributions shipping libxml2 < 2.15.4 as a system library

Discovery Timeline

• 2026-09-05 - CVE-2026-86139 published to the National Vulnerability Database
• 2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86139

Vulnerability Analysis

The vulnerability is an integer overflow [CWE-190] in the xmlURIEscapeStr routine defined in uri.c. The function computes an allocation size by taking the length of the input string and adding a constant padding value. When the input length approaches the maximum value representable by the size variable, the addition wraps, producing a small allocation that cannot hold the resulting escaped string. Subsequent writes exceed the allocated buffer.

The advisory records local attack vector, high attack complexity, and no privileges or user interaction requirement. Successful exploitation can compromise confidentiality and integrity of the affected process, with lower impact on availability. The EPSS probability score is 0.108%, indicating limited observed exploitation activity to date.

Root Cause

The root cause is missing bounds validation on the string length prior to arithmetic on the allocation size. The pre-patch code computed len = xmlStrlen(str) and then executed len += 20 before calling xmlMalloc(len) without verifying that the input length was non-zero or that the addition would not overflow. An oversized or specifically shaped input violates the assumption that len + 20 produces a valid allocation size.

Attack Vector

Exploitation requires local delivery of a crafted URI string to an application that invokes xmlURIEscapeStr. This typically occurs when a program parses attacker-supplied XML, XSLT, or URI content through libxml2. The high attack complexity reflects the need to shape input that triggers the overflow condition reliably on the target platform.

// Patch: add length check to xmlURIEscapeStr in uri.c
    if (str[0] == 0)
	return(xmlStrdup(str));
    len = xmlStrlen(str);
+   if (len == 0)
+       return(NULL);

    len += 20;
    ret = xmlMalloc(len);

Source: GitHub libxml2 Commit 8edbbdb

Detection Methods for CVE-2026-86139

Indicators of Compromise

• Unexpected crashes, SIGSEGV, or heap corruption reports in processes that link against libxml2 while parsing URI or XML content
• Sanitizer output (ASan, UBSan) flagging heap-buffer-overflow inside xmlURIEscapeStr or callers in uri.c
• Anomalous child process termination in web servers, XSLT processors, or scripting runtimes handling untrusted XML

Detection Strategies

• Inventory installed libxml2 versions across Linux hosts using package manager queries such as dpkg -l libxml2 or rpm -q libxml2 and flag builds prior to 2.15.4
• Scan container images and language runtime environments (Python, Ruby, PHP, Node) for bundled libxml2 shared objects below the fixed version
• Enable core dump collection and centralized crash reporting to surface exploitation attempts against XML parsing services

Monitoring Recommendations

• Ingest host telemetry and crash logs into a centralized data lake and alert on repeated crashes in processes that consume XML or URI input
• Monitor package management events for installations or downgrades of libxml2 below version 2.15.4
• Track file access patterns for XML and XSLT documents originating from untrusted sources to correlate with parser crashes

How to Mitigate CVE-2026-86139

Immediate Actions Required

• Upgrade libxml2 to version 2.15.4 or later across all affected hosts, container images, and application bundles
• Rebuild and redeploy applications that statically link libxml2 to ensure the patched code path is loaded
• Restrict local delivery of untrusted XML and URI content to services that have not yet received the update

Patch Information

The fix is committed in the upstream GNOME libxml2 repository and shipped in release 2.15.4. The patch adds an explicit len == 0 check in xmlURIEscapeStr before the length arithmetic and allocation, preventing the overflow condition. Review the GitHub libxml2 Version Comparison for the full set of changes between 2.15.3 and 2.15.4, and apply distribution-provided backports when available.

Workarounds

• Where immediate patching is not possible, disable or sandbox application features that parse untrusted XML or URI input through libxml2
• Run affected services under reduced privileges and with memory protections such as ASLR and heap hardening enabled
• Validate and length-limit externally supplied URI strings at the application layer before passing them to libxml2 APIs

# Verify installed libxml2 version and update on Debian/Ubuntu
dpkg -l libxml2 | grep libxml2
sudo apt-get update && sudo apt-get install --only-upgrade libxml2

# Verify installed libxml2 version and update on RHEL/Fedora
rpm -q libxml2
sudo dnf upgrade libxml2