CVE-2026-86141: libxml2 Use After Free Vulnerability

CVE-2026-86141 Overview

CVE-2026-86141 is a NULL pointer dereference vulnerability in the xmlregexp component of libxml2 versions prior to 2.15.4. The flaw resides in the xmlRegNewParserCtxt function, which calls strlen() on a string returned by xmlStrdup() without first verifying that the allocation succeeded. When xmlStrdup() returns NULL due to memory allocation failure, the subsequent strlen() call dereferences a NULL pointer and crashes the process. The issue is classified under [CWE-252: Unchecked Return Value]. Exploitation requires local access and yields only availability impact, with no confidentiality or integrity consequences.

Critical Impact
Local attackers can trigger a process crash in applications linking libxml2 by inducing memory allocation failure during regular expression parser context creation.

Affected Products

libxml2 versions prior to 2.15.4
Applications and libraries that embed vulnerable libxml2 builds
Linux distributions and platforms shipping unpatched libxml2 packages

Discovery Timeline

2026-09-05 - CVE-2026-86141 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86141

Vulnerability Analysis

The vulnerability exists in xmlregexp.c within the xmlRegNewParserCtxt function. This function allocates a parser context, copies an input string via xmlStrdup(), and then computes its length with strlen(). The original code performed the strlen() call before checking whether xmlStrdup() succeeded. If the string duplication fails and returns NULL, strlen() dereferences a NULL pointer and the process aborts. The bug affects any consumer of libxml2 that constructs a regular expression parser context from attacker-influenced input while the process is under memory pressure. Impact is limited to denial of service against the affected process.

Root Cause

The root cause is an ordering error in error handling. The function assumed that xmlStrdup() would always return a valid pointer and computed the string length before validating the allocation result. Under low-memory conditions, allocation failure is a legitimate runtime state that must be handled before any dereference. The pattern falls under [CWE-252], where a return value indicating failure is used without being checked.

Attack Vector

The attack vector is local. An attacker who can influence memory availability on the host, or who can supply input to a long-running process that parses XML regular expressions, may trigger the NULL pointer dereference by forcing xmlStrdup() to fail. The result is a crash of the process holding the libxml2 context. There is no path to code execution, data disclosure, or integrity compromise from this flaw.

// Patch from libxml2 commit e89a8aae4c9b40cdafcf66b3f9e57c62db37bb55
// xmlregexp: Calc string length after null checking
 	return(NULL);
     memset(ret, 0, sizeof(xmlRegParserCtxt));
     if (string != NULL) {
-	ret->string = xmlStrdup(string);
-	ret->len = strlen((const char *) ret->string);
+        ret->string = xmlStrdup(string);
         if (ret->string == NULL) {
             xmlFree(ret);
             return(NULL);
         }
+        ret->len = strlen((const char *) ret->string);
     }
     ret->cur = ret->string;
     ret->neg = 0;

Source: GitHub Commit for libxml2. The patch reorders the logic so ret->string is validated for NULL before strlen() is invoked, and the context is freed if allocation failed.

Detection Methods for CVE-2026-86141

Indicators of Compromise

Unexpected SIGSEGV or abort signals originating from processes that link libxml2 and invoke regular expression APIs.
Core dumps whose backtraces include xmlRegNewParserCtxt and strlen frames from libxml2.
Application or service crash loops correlated with periods of host memory exhaustion.

Detection Strategies

Inventory installed libxml2 versions across endpoints and servers and flag any build earlier than 2.15.4.
Correlate crash telemetry with libxml2 version data to identify affected workloads before patch rollout.
Review application logs for repeated parser initialization failures in components that process XML schema regular expressions.

Monitoring Recommendations

Monitor system memory pressure and out-of-memory events on hosts running services that parse untrusted XML.
Alert on process restart patterns for daemons and services that embed libxml2.
Track package inventory changes to confirm patched libxml2 versions are deployed and remain deployed after updates.

How to Mitigate CVE-2026-86141

Immediate Actions Required

Upgrade libxml2 to version 2.15.4 or later on all systems where the library is installed.
Rebuild or repackage any statically linked applications that bundle libxml2 with the patched release.
Restart long-running services after upgrading to ensure the updated library is loaded into memory.

Patch Information

The fix is committed upstream at GitHub Commit for libxml2 and included in the GitHub Release Comparison v2.15.3 to v2.15.4. Additional tracking is available at the GitLab Work Item #1107 for libxml2. Distribution maintainers ship the fix in updated packages; apply vendor updates through the standard package manager.

Workarounds

Restrict local access to hosts running services that use libxml2 to reduce the population able to induce memory pressure.
Apply resource limits and memory guardrails to processes parsing untrusted XML so allocation failure conditions are less reachable.
Isolate XML parsing workloads in supervised containers or service managers that automatically restart crashed processes.

bash

# Verify installed libxml2 version on Debian and Ubuntu
dpkg -l libxml2 | awk '/libxml2/ {print $2, $3}'

# Verify installed libxml2 version on RHEL and derivatives
rpm -q libxml2

# Upgrade libxml2 through the package manager
sudo apt-get update && sudo apt-get install --only-upgrade libxml2
sudo dnf upgrade libxml2