CVE-2026-86140: CWE-121 Stack-based Buffer Overflow in xmlsoft libxml2

CVE-2026-86140 is a stack-based buffer overflow vulnerability in the xmlSnprintfElements function of libxml2 prior to version 2.15.4. The issue arises due to unsafe use of strcat, which can overflow a stack buffer, potentially allowing an attacker to execute arbitrary code or cause denial of service. The vulnerability has been assigned a CVSS v3.1 score of 8.0, indicating high severity with local attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker with local access to execute arbitrary code, compromise system confidentiality and integrity, or cause a denial of service by crashing the affected application. The vulnerability affects the core XML parsing library libxml2, which is widely used in many applications, potentially increasing the impact surface.

A fix is available in libxml2 version 2.15.4. Users and administrators should upgrade to version 2.15.4 or later to remediate this vulnerability. No vendor advisory content was provided, so patch status is based on the version information indicating the fix is in 2.15.4.