A stack-based buffer overflow vulnerability exists in libxml2 versions before 2.15.4 in the xmlSnprintfElements function within valid.c. This flaw involves the use of strcat, which can lead to memory corruption. The vulnerability has a high severity with a CVSS score of 8.0 and impacts confidentiality, integrity, and availability.
CVE-2026-86144 is a vulnerability in libxml2's xinclude functionality before version 2.15.4 where certain parsing flags, such as XML_PARSE_NONET, are not propagated during processing. This can lead to security issues including XML external entity injection, server-side request forgery (SSRF), or denial of service if a custom resource loader accesses attacker-controlled internet resources.
CVE-2026-86143 is an integer coercion error in libxml2 before version 2.15.4. The vulnerability arises from an inconsistency between xmlOutputWriteCallback and xmlBufUse, allowing negative lengths to be passed to write callbacks due to a missing integer overflow check. This flaw can impact confidentiality, integrity, and availability in affected systems.
xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.
CVE-2026-86139 is an integer overflow vulnerability in the xmlURIEscapeStr function of libxml2 before version 2.15.4. This flaw could lead to high impact on confidentiality and integrity, with limited impact on availability. The vulnerability has a medium severity rating and affects versions prior to 2.15.4.
A vulnerability in libxml2 before version 2.15.4 allows an integer overflow in the xmlDictAddQString function, leading to a heap-based buffer overflow. This flaw can result in high confidentiality and integrity impact, with a low availability impact. The vulnerability has a CVSS score of 6.9, indicating a medium severity level.
libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking.
By supplying an overly long input line, an attacker can overflow internal buffers (command, arg, and argv) during input parsing. This results in memory corruption within the stack frame.
Successful exploitation may cause a crash or potentially allow arbitrary code execution in the context of the xmlcatalog process.
This issue has been fixed in the commit c2e233fc.
NOTE:
The maintainers of this project did not agree that this issue is a vulnerability and considered it a bug.
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.
In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.
In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.
numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.
