CVE-2026-86142: libxml2 Buffer Overflow Vulnerability

CVE-2026-86142 Overview

CVE-2026-86142 is a heap-based buffer overflow [CWE-122] in the libxml2 XML parsing library affecting versions before 2.15.4. The flaw resides in the xmlXPtrEvalXPtrPart function and stems from XPointer length saturation in xmlXPtrEval. An attacker who can supply a crafted XPointer expression to a local process using libxml2 may trigger heap corruption, leading to memory disclosure, integrity loss, or process crash. libxml2 is embedded in a wide range of applications, browsers, and language runtimes, expanding the practical attack surface.

Critical Impact
Successful exploitation can corrupt heap memory in any local application that parses attacker-influenced XML through libxml2, enabling code execution or process compromise.

Affected Products

GNOME libxml2 versions prior to 2.15.4
Applications statically or dynamically linking vulnerable libxml2 releases
Downstream distributions and language bindings shipping libxml2 < 2.15.4

Discovery Timeline

2026-09-05 - CVE-2026-86142 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86142

Vulnerability Analysis

The defect is a heap-based buffer overflow [CWE-122] in the XPointer evaluation path of libxml2. When xmlXPtrEval processes an XPointer, it computes the length of the current expression using xmlStrlen. On extremely long inputs, xmlStrlen returns a saturated or negative value that is not validated before use. xmlXPtrEvalXPtrPart then adds one to the returned length and passes the result to xmlMalloc, producing an undersized allocation. Subsequent copy operations write past the allocated heap buffer, corrupting adjacent heap metadata and objects.

Exploitation requires local access and non-trivial conditions, but libxml2 is embedded in browsers, office suites, package managers, and scripting runtimes. Any of these can become an exploitation surface when they expose XPointer parsing to attacker-controlled data.

Root Cause

The root cause is missing overflow validation on the return value of xmlStrlen. When the source string exceeds representable bounds, xmlStrlen saturates to zero while the pointer still references non-empty data. The subsequent len++ and xmlMalloc(len) create a one-byte buffer that cannot hold the copied content, yielding an out-of-bounds heap write.

Attack Vector

The attack vector is local. A threat actor supplies a specially crafted XML document containing a malicious XPointer expression to an application that uses libxml2 for XPointer evaluation. Processing the document triggers the undersized allocation and subsequent heap overflow within the victim process context.

    level = 1;

    len = xmlStrlen(ctxt->cur);
    /* Overflow in xmlStrlen */
    if (len == 0 && ctxt->cur != NULL && *ctxt->cur != 0) {
        xmlXPathPErrMemory(ctxt);
        xmlFree(name);
        return;
    }

    len++;
    buffer = xmlMalloc(len);
    if (buffer == NULL) {

Source: GitHub Commit for libxml2 — the patch adds an explicit check that rejects saturated xmlStrlen results before the allocation.

Detection Methods for CVE-2026-86142

Indicators of Compromise

Unexpected crashes or segmentation faults in processes linked against libxml2 when parsing XML with XPointer fragments
Heap corruption signatures reported by AddressSanitizer, glibc malloc tcache checks, or Windows Page Heap in XML-processing applications
XML input files containing abnormally long XPointer expressions targeting xmlXPtrEvalXPtrPart

Detection Strategies

Inventory installed libxml2 versions across endpoints and build pipelines and flag any release below 2.15.4
Use software composition analysis to identify statically linked or vendored libxml2 within third-party applications
Enable core dump capture on applications that process untrusted XML to identify crashes consistent with heap corruption in xpointer.c

Monitoring Recommendations

Monitor process crash telemetry for repeated faults in modules that include libxml2 symbols
Alert on file writes or downloads of XML documents containing oversized XPointer expressions
Track patch adoption for libxml2 in package repositories and container base images used by production workloads

How to Mitigate CVE-2026-86142

Immediate Actions Required

Upgrade libxml2 to version 2.15.4 or later on all systems and rebuild dependent applications
Update operating system packages once distribution maintainers publish backported fixes
Restrict processing of untrusted XML documents in applications that expose XPointer functionality

Patch Information

The fix is committed upstream in GNOME libxml2 and released in version 2.15.4. The patch validates the xmlStrlen return value in xmlXPtrEvalXPtrPart and aborts allocation when saturation is detected. Refer to the GitHub Commit for libxml2, the GitHub Release Comparison v2.15.3 to v2.15.4, and the GNOME Work Item #1113 for libxml2 for full details.

Workarounds

Disable XPointer evaluation in applications where it is not required by configuration or by omitting the XPTR_ENABLED build option
Reject or sanitize XML documents from untrusted sources before parsing them with libxml2
Run XML-processing services under least-privilege accounts and process isolation to limit blast radius from heap corruption

bash

# Verify installed libxml2 version and upgrade
xml2-config --version
# On Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade libxml2
# On RHEL/Fedora
sudo dnf upgrade libxml2
# Confirm patched version
xml2-config --version   # should report 2.15.4 or later