CVE-2026-86141

xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.

xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.

xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.

• SECURITY UPDATE: stack buffer overflow in xmlSnprintfElements()
  • debian/patches/CVE-2026-86140.patch: add bounds checks around the parenthesis writes in xmlSnprintfElements() in valid.c
  • CVE-2026-86140
• SECURITY UPDATE: NULL pointer dereference in xmlRegNewParserCtxt() after a failed allocation
  • debian/patches/CVE-2026-86141.patch: check the xmlStrdup() result in xmlRegNewParserCtxt() in xmlregexp.c so a failed allocation cannot leave a NULL parser cursor
  • CVE-2026-86141
• SECURITY UPDATE: heap buffer overflow in xmlXPtrEvalXPtrPart() on oversized xpointer() expressions
  • debian/patches/CVE-2026-86142.patch: make xmlStrlen() in xmlstring.c saturate above INT_MAX and reject the saturated length in xmlXPtrEvalXPtrPart() in xpointer.c before sizing the buffer
  • CVE-2026-86142
• SECURITY UPDATE: integer overflow before the output write callback
  • debian/patches/CVE-2026-86143.patch: check for integer overflow before passing a buffer length to the write callback in xmlIO.c
  • CVE-2026-86143
• SECURITY UPDATE: parse flags not propagated by xmlXIncludeProcess() and xmlXIncludeProcessTree()
  • debian/patches/CVE-2026-86144.patch: propagate the document parse flags in xmlXIncludeProcess() and xmlXIncludeProcessTree() in xinclude.c
  • CVE-2026-86144

• CVE-2026-86140: add bounds checks around the parenthesis writes in xmlSnprintfElements
• CVE-2026-86141: check the xmlStrdup result in xmlRegNewParserCtxt so a failed allocation cannot leave a NULL parser cursor
• CVE-2026-86142: make xmlStrlen saturate above INT_MAX and reject the saturated length in xmlXPtrEvalXPtrPart before sizing the buffer
• CVE-2026-86143: check for integer overflow before passing a buffer length to the output write callback
• CVE-2026-86144: propagate the document parse flags in xmlXIncludeProcess and xmlXIncludeProcessTree

• CVE-2026-86140: add bounds checks around the parenthesis writes in xmlSnprintfElements
• CVE-2026-86141: check the xmlStrdup result in xmlRegNewParserCtxt so a failed allocation cannot leave a NULL parser cursor
• CVE-2026-86142: make xmlStrlen saturate above INT_MAX and reject the saturated length in xmlXPtrEvalXPtrPart before sizing the buffer
• CVE-2026-86143: check for integer overflow before passing a buffer length to the output write callback
• CVE-2026-86144: propagate the document parse flags in xmlXIncludeProcess and xmlXIncludeProcessTree

• CVE-2026-86140: add bounds checks around the parenthesis writes in xmlSnprintfElements
• CVE-2026-86141: check the xmlStrdup result in xmlRegNewParserCtxt so a failed allocation cannot leave a NULL parser cursor
• CVE-2026-86142: make xmlStrlen saturate above INT_MAX and reject the saturated length in xmlXPtrEvalXPtrPart before sizing the buffer
• CVE-2026-86143: check for integer overflow before passing a buffer length to the output write callback
• CVE-2026-86144: propagate the document parse flags in xmlXIncludeProcess and xmlXIncludeProcessTree

The updated packages fix several security issues: Stack-Based Buffer Overflow in libxml2. (CVE-2026-11979) In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp. (CVE-2026-86137) In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow. (CVE-2026-86138) In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow. (CVE-2026-86139) In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow. (CVE-2026-86140) xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking. (CVE-2026-86141) In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation. (CVE-2026-86142) In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback. (CVE-2026-86143) In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow). (CVE-2026-86144)