CVE-2026-86143: libxml2 Buffer Overflow Vulnerability

CVE-2026-86143 Overview

CVE-2026-86143 is an integer overflow vulnerability in libxml2 versions prior to 2.15.4. The flaw resides in the xmlIO component, where an inconsistency between xmlOutputWriteCallback and xmlBufUse allows negative length values to reach write callbacks. The root cause is a missing integer overflow check before invoking writecallback, tracked under [CWE-192] (Integer Coercion Error).

Because libxml2 is embedded across countless applications, operating systems, and language runtimes, any downstream consumer that trusts the length parameter passed to a write callback may exhibit undefined behavior, memory corruption, or incorrect processing.

Critical Impact
A local attacker who can influence XML output buffers can trigger integer overflow conditions, causing negative length values to be passed to write callbacks with potential impact on confidentiality and integrity.

Affected Products

GNOME libxml2 versions prior to 2.15.4
Applications statically or dynamically linking vulnerable libxml2 builds
Operating system distributions redistributing libxml2 < 2.15.4

Discovery Timeline

2026-09-05 - CVE-2026-86143 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86143

Vulnerability Analysis

The vulnerability exists in libxml2's I/O layer (xmlIO.c), which serializes XML output through user-supplied or built-in write callbacks. The internal buffer accounting routine xmlBufUse can return values that exceed the range of a signed int. When this value is passed to xmlOutputWriteCallback, the implicit conversion produces a negative length. Downstream write callbacks then receive a negative size parameter that they treat as a valid int.

Callbacks that pass this value to memory copy routines, socket writes, or file descriptor operations can misbehave in security-relevant ways. Depending on the callback implementation, consequences include buffer over-reads, out-of-bounds writes, memory corruption, or truncated writes producing malformed output. The issue is exploitable locally through XML processing workflows that produce large output buffers.

Root Cause

The defect is a missing bounds check on nbchars before invoking out->writecallback. xmlBufUse returns a size_t accumulated across chunked serialization, but the callback signature uses int. Without validating that nbchars fits in INT_MAX, the cast silently wraps into a negative value ([CWE-192]).

Attack Vector

Exploitation requires local access and high attack complexity. An attacker must supply XML content that, when serialized, produces output buffers exceeding INT_MAX bytes, forcing the accounting variable to overflow when narrowed to int. The scenario typically requires processing large or attacker-controlled documents through applications that expose libxml2 serialization to untrusted input.

            if (nbchars < MINLEN)
                break;

+           if (nbchars >= INT_MAX) {
+               out->error = XML_ERR_INTERNAL_ERROR;
+               return(-1);
+           }
+
            ret = out->writecallback(out->context,
                       (const char *)xmlBufContent(buf), nbchars);
            if (ret < 0) {

Source: libxml2 commit 90f293ba74d2. The upstream patch adds a guard so that nbchars >= INT_MAX triggers XML_ERR_INTERNAL_ERROR and returns -1 before the write callback is invoked.

Detection Methods for CVE-2026-86143

Indicators of Compromise

Application crashes or aborts during XML serialization of large documents
Unexpected XML_ERR_INTERNAL_ERROR events emitted by patched libxml2 builds
Truncated or malformed XML output files exceeding multi-gigabyte buffer thresholds
Anomalous write syscalls with negative or extremely large length arguments originating from XML-processing services

Detection Strategies

Inventory installed libxml2 versions on all Linux, macOS, and Windows hosts and flag any build below 2.15.4
Query software composition analysis (SCA) tools for applications bundling vulnerable libxml2 in containers or language package dependencies
Enable runtime crash reporting on services that perform bulk XML serialization to surface overflow-induced faults

Monitoring Recommendations

Monitor process telemetry for repeated segmentation faults or aborts in binaries that link libxml2.so
Alert on syscalls to write() or writev() with unusually large or negative length arguments from XML processors
Track patch compliance for libxml2 across container images and base OS packages through your vulnerability management workflow

How to Mitigate CVE-2026-86143

Immediate Actions Required

Upgrade libxml2 to version 2.15.4 or later on all affected systems
Rebuild and redeploy applications that statically link libxml2 against the patched release
Update container base images and language runtimes that bundle libxml2
Restrict local access to services performing XML serialization on untrusted inputs

Patch Information

The fix is delivered in libxml2 2.15.4. Review the version comparison v2.15.3...v2.15.4 and upstream GitLab work item #1111 for the complete change set. The patch introduces an explicit INT_MAX check on nbchars before invoking writecallback, returning XML_ERR_INTERNAL_ERROR when the length would overflow.

Workarounds

Limit the size of XML documents accepted by applications built on unpatched libxml2 to values well below INT_MAX bytes
Avoid streaming very large serialized outputs through custom xmlOutputWriteCallback implementations until patched
Enforce resource quotas on processes performing XML serialization to reduce the likelihood of buffer growth into overflow territory

bash

# Verify installed libxml2 version on Debian/Ubuntu
dpkg -l | grep libxml2

# Verify on RHEL/Fedora/CentOS
rpm -q libxml2

# Upgrade example (Debian/Ubuntu)
sudo apt-get update && sudo apt-get install --only-upgrade libxml2

# Confirm patched version (should report 2.15.4 or later)
xmllint --version 2>&1 | head -n 1