The libxml2 library's xmlcatalog utility in --shell mode is vulnerable to multiple stack-based buffer overflows due to the usershell() function processing user input with fixed-size stack buffers without proper bounds checking. Overly long input lines can overflow internal buffers such as command, arg, and argv, causing stack memory corruption. This may result in a crash or potentially arbitrary code execution within the xmlcatalog process context. The vulnerability has been addressed in commit c2e233fc. The maintainers do not classify this as a security vulnerability but as a bug. No explicit remediation level or patch advisory is provided in the available data.

Exploitation of this vulnerability can cause a crash of the xmlcatalog utility or potentially allow arbitrary code execution within its process context. The CVSS 4.0 score of 1.8 indicates low severity with local attack vector, low complexity, and partial attack impact. No known exploits in the wild have been reported.

The vulnerability has been fixed in commit c2e233fc. Users should update libxml2 to a version that includes this fix. Since no official vendor advisory or patch link is provided, users should verify the presence of this commit in their libxml2 version or obtain an updated release from the maintainers. No additional mitigation guidance is available from the vendor, and the maintainers consider this a bug rather than a security vulnerability.