CVE-2026-86139

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.

The updated packages fix several security issues: Stack-Based Buffer Overflow in libxml2. (CVE-2026-11979) In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp. (CVE-2026-86137) In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow. (CVE-2026-86138) In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow. (CVE-2026-86139) In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow. (CVE-2026-86140) xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking. (CVE-2026-86141) In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation. (CVE-2026-86142) In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback. (CVE-2026-86143) In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow). (CVE-2026-86144)

Yirou Yang discovered that libxml2 incorrectly handled certain XML catalogs. If a user or automated system was tricked into processing a specially crafted XML catalog, an attacker could possibly use this issue to cause libxml2 to crash, resulting in a denial of service. (CVE-2026-76781)

It was discovered that libxml2 incorrectly handled certain large qualified names, leading to a heap-based buffer overflow. An attacker could possibly use this issue to cause libxml2 to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-86138)

It was discovered that libxml2 incorrectly handled escaping certain large URI strings. An attacker could possibly use this issue to cause libxml2 to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-86139)

Xudong Cao and Meng Xu discovered that libxml2 incorrectly handled certain large XPointer expressions, leading to a heap-based buffer overflow. An attacker could possibly use this issue to cause libxml2 to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-86142)

Xudong Cao and Meng Xu discovered that libxml2 did not check for integer overflows before passing output lengths to write callbacks. An attacker could possibly use this issue to cause an application using libxml2 to crash, resulting in a denial of service. (CVE-2026-86143)

It was discovered that libxml2 did not apply parser options, such as disabling network access, when processing XInclude directives under certain circumstances. An attacker could possibly use this issue to perform XML external entity injection or server-side request forgery attacks, or cause a denial of service. (CVE-2026-86144)