{"id":"CVE-2026-86141","aliases":["AZL-99708","BELL-CVE-2026-86141","CLSA-2026-1789601022","CLSA-2026-1789668093","CLSA-2026-1789668422","CLSA-2026-1789780589","DEBIAN-CVE-2026-86141","EUVD-2026-71834","GHSA-7g6w-jj32-qj92","MGASA-2026-0459","RHSA-2026:64463","UBUNTU-CVE-2026-86141"],"status":"published","title":"xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a...","description":"xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.","severity":{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00165,"percentile":0.05781,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-252"],"published":"2026-09-05T04:27:59Z","modified":"2026-10-28T11:19:04Z","fixes":[{"ecosystem":"Debian:14","package":"libxml2","fixed_in":["2.15.4+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.11.5-10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.7+tuxcare.els16"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libxml2-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.7+tuxcare.els16"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libxml2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.7+tuxcare.els16"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libxml2-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.7+tuxcare.els16"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"python-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.7+tuxcare.els16"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-9.el8_4.2.tuxcare.els18"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-9.el8_4.2.tuxcare.els18"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-9.el8_4.2.tuxcare.els18"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-9.el8_4.2.tuxcare.els18"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-9.el8_4.2.tuxcare.els18"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-9.el8_4.2.tuxcare.els18"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-9.el8_4.2.tuxcare.els18"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-9.el8_4.2.tuxcare.els18"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-18.el8.tuxcare.els13"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-18.el8.tuxcare.els13"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-18.el8.tuxcare.els13"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-18.el8.tuxcare.els13"}]}],"bundled":5},{"source":"osv","ecosystem":"Debian:13","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.7+dfsg+really2.9.14-2.1","2.12.7+dfsg+really2.9.14-2.1+deb13u1","2.12.7+dfsg+really2.9.14-2.1+deb13u2","2.12.7+dfsg+really2.9.14-2.1+deb13u3","2.13.1+dfsg-0exp1","2.13.3+dfsg-0exp1","2.13.3+dfsg-0exp2","2.14.1+dfsg-0exp1","2.14.2+dfsg-0exp1","2.14.3+dfsg-0exp1","2.14.3+dfsg-0exp2","2.14.3+dfsg-0exp3","2.14.4+dfsg-0exp1","2.14.5+dfsg-0.1","2.14.5+dfsg-0.2","2.14.5+dfsg-0exp1","2.14.5+dfsg-0exp2","2.14.6+dfsg-0.1","2.15.0+dfsg-0.1","2.15.0+dfsg-0.2","2.15.0+dfsg-0.3","2.15.1+dfsg-0.1","2.15.1+dfsg-0.2","2.15.1+dfsg-0.3","2.15.1+dfsg-0.4","2.15.1+dfsg-0.5","2.15.1+dfsg-1","2.15.1+dfsg-2","2.15.2+dfsg-0.1","2.15.3+dfsg-1","2.15.4+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.4+dfsg-1"}]}],"versions":["2.12.7+dfsg+really2.9.14-2.1","2.13.1+dfsg-0exp1","2.13.3+dfsg-0exp1","2.13.3+dfsg-0exp2","2.14.1+dfsg-0exp1","2.14.2+dfsg-0exp1","2.14.3+dfsg-0exp1","2.14.3+dfsg-0exp2","2.14.3+dfsg-0exp3","2.14.4+dfsg-0exp1","2.14.5+dfsg-0.1","2.14.5+dfsg-0.2","2.14.5+dfsg-0exp1","2.14.5+dfsg-0exp2","2.14.6+dfsg-0.1","2.15.0+dfsg-0.1","2.15.0+dfsg-0.2","2.15.0+dfsg-0.3","2.15.1+dfsg-0.1","2.15.1+dfsg-0.2","2.15.1+dfsg-0.3","2.15.1+dfsg-0.4","2.15.1+dfsg-0.5","2.15.1+dfsg-1","2.15.1+dfsg-2","2.15.2+dfsg-0.1","2.15.3+dfsg-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.1-3.2.mga10"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.4-0.1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libxml2-16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.4-0.1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.4-0.1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.4-0.1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.4-0.1.hum1"}]}],"bundled":9}],"products":[{"vendor":"gnome","product":"libxml2"},{"vendor":"xmlsoft","product":"libxml2"}],"references":[{"url":"https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4","tags":["Release Notes","web","article"]},{"url":"https://github.com/GNOME/libxml2/commit/e89a8aae4c9b40cdafcf66b3f9e57c62db37bb55","tags":["Patch","fix","article"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1107","tags":["Vendor Advisory","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86141","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-7g6w-jj32-qj92"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-86141","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1789601022.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86140","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86142","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86144","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1789668093.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1789668422.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1789780589.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86141.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-86141","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0459.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35932","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/ZWJ6JIPH33FSDSBTGTTXHQQKFJEXIKRU/","tags":["web"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1124","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/04/5","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/05/4","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:64463","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86137","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86143","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86141","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86140","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86138","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86144","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86139","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86142","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-74860","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_64463.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529697","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-74860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74860","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528985","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86137","tags":["advisory"]},{"url":"https://github.com/GNOME/libxml2/commit/76fe08d97de88bfaef2f7d5cd27f11954cc5bee2","tags":["article"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1099","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528986","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86138","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86138","tags":["advisory"]},{"url":"https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528991","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86139","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86139","tags":["advisory"]},{"url":"https://github.com/GNOME/libxml2/commit/8edbbdb09f24d26a2f900141fddc2b9d014f53b0","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528989","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86140","tags":["advisory"]},{"url":"https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528988","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86141","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528990","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86142","tags":["advisory"]},{"url":"https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58","tags":["article"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528987","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86143","tags":["advisory"]},{"url":"https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35","tags":["article"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528992","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86144","tags":["advisory"]},{"url":"https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-86141","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-86141","description":"xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.","status":"published","published":"2026-09-05T04:27:59.795Z","modified":"2026-09-09T19:15:52.468Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-252"],"updated_at":"2026-11-02T13:49:42.666099Z"}],"euvd":[{"id":"EUVD-2026-71834","description":"xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.","status":"published","published":"2026-09-05T04:27:59Z","modified":"2026-09-09T19:15:52Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T17:28:25.986684Z"}],"ghsa":[{"id":"GHSA-7g6w-jj32-qj92","title":"xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a...","description":"xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.","status":"published","published":"2026-09-05T06:32:37Z","modified":"2026-09-05T06:32:37Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-252"],"updated_at":"2026-11-02T15:11:24.326884Z"}],"nvd":[{"id":"CVE-2026-86141","description":"xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.","status":"published","published":"2026-09-05T05:17:13.007Z","modified":"2026-09-15T19:37:41.44Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"primary"}],"cwes":["CWE-252"],"updated_at":"2026-11-02T14:12:44.082631Z"}],"osv":[{"id":"BELL-CVE-2026-86141","title":"CVE-2026-86141 does not affect BellSoft software","status":"withdrawn","published":"2026-09-08T06:05:22.407208Z","modified":"2026-09-17T07:15:07.36695392Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:28:26.341144Z"},{"id":"CVE-2026-86141","description":"xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.","status":"published","published":"2026-09-05T04:27:59.795Z","modified":"2026-10-28T11:19:04.162905423Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-252"],"updated_at":"2026-11-02T15:45:18.825071Z"},{"id":"DEBIAN-CVE-2026-86141","description":"xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.","status":"published","published":"2026-09-05T05:17:13.007Z","modified":"2026-10-04T15:00:08.354443911Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:46:05.022702Z"},{"id":"RHSA-2026:64463","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-09T10:19:53Z","modified":"2026-10-16T10:22:19Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"UBUNTU-CVE-2026-86141","description":"xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.","status":"withdrawn","published":"2026-09-05T05:17:00Z","modified":"2026-10-09T07:45:02.906798075Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"AZL-99708","title":"CVE-2026-86141 affecting package libxml2 2.11.5-10","description":"xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.","status":"published","published":"2026-09-05T05:17:13Z","modified":"2026-09-08T05:27:28Z","updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"CLSA-2026-1789601022","title":"Fix of 5 CVEs","description":"   * SECURITY UPDATE: stack buffer overflow in xmlSnprintfElements()\n     - debian/patches/CVE-2026-86140.patch: add bounds checks around the\n       parenthesis writes in xmlSnprintfElements() in valid.c\n     - CVE-2026-86140\n   * SECURITY UPDATE: NULL pointer dereference in xmlRegNewParserCtxt() after\n     a failed allocation\n     - debian/patches/CVE-2026-86141.patch: check the xmlStrdup() result in\n       xmlRegNewParserCtxt() in xmlregexp.c so a failed allocation cannot\n       leave a NULL parser cursor\n     - CVE-2026-86141\n   * SECURITY UPDATE: heap buffer overflow in xmlXPtrEvalXPtrPart() on\n     oversized xpointer() expressions\n     - debian/patches/CVE-2026-86142.patch: make xmlStrlen() in xmlstring.c\n       saturate above INT_MAX and reject the saturated length in\n       xmlXPtrEvalXPtrPart() in xpointer.c before sizing the buffer\n     - CVE-2026-86142\n   * SECURITY UPDATE: integer overflow before the output write callback\n     - debian/patches/CVE-2026-86143.patch: check for integer overflow before\n       passing a buffer length to the write callback in xmlIO.c\n     - CVE-2026-86143\n   * SECURITY UPDATE: parse flags not propagated by xmlXIncludeProcess() and\n     xmlXIncludeProcessTree()\n     - debian/patches/CVE-2026-86144.patch: propagate the document parse\n       flags in xmlXIncludeProcess() and xmlXIncludeProcessTree() in\n       xinclude.c\n     - CVE-2026-86144","status":"published","published":"2026-09-16T23:23:57Z","modified":"2026-10-26T09:32:02.512365505Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1789668093","title":"libxml2: Fix of 5 CVEs","description":"- CVE-2026-86140: add bounds checks around the parenthesis writes in xmlSnprintfElements\n- CVE-2026-86141: check the xmlStrdup result in xmlRegNewParserCtxt so a failed allocation cannot leave a NULL parser cursor\n- CVE-2026-86142: make xmlStrlen saturate above INT_MAX and reject the saturated\n  length in xmlXPtrEvalXPtrPart before sizing the buffer\n- CVE-2026-86143: check for integer overflow before passing a buffer length to the output write callback\n- CVE-2026-86144: propagate the document parse flags in xmlXIncludeProcess and xmlXIncludeProcessTree","status":"published","published":"2026-09-17T18:01:48Z","modified":"2026-10-26T09:31:51.528291438Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1789668422","title":"libxml2: Fix of 5 CVEs","description":"- CVE-2026-86140: add bounds checks around the parenthesis writes in xmlSnprintfElements\n- CVE-2026-86141: check the xmlStrdup result in xmlRegNewParserCtxt so a failed allocation cannot leave a NULL parser cursor\n- CVE-2026-86142: make xmlStrlen saturate above INT_MAX and reject the saturated\n  length in xmlXPtrEvalXPtrPart before sizing the buffer\n- CVE-2026-86143: check for integer overflow before passing a buffer length to the output write callback\n- CVE-2026-86144: propagate the document parse flags in xmlXIncludeProcess and xmlXIncludeProcessTree","status":"published","published":"2026-09-17T18:07:17Z","modified":"2026-10-26T09:31:50.616503933Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1789780589","title":"libxml2: Fix of 5 CVEs","description":"- CVE-2026-86140: add bounds checks around the parenthesis writes in xmlSnprintfElements\n- CVE-2026-86141: check the xmlStrdup result in xmlRegNewParserCtxt so a failed allocation cannot leave a NULL parser cursor\n- CVE-2026-86142: make xmlStrlen saturate above INT_MAX and reject the saturated\n  length in xmlXPtrEvalXPtrPart before sizing the buffer\n- CVE-2026-86143: check for integer overflow before passing a buffer length to the output write callback\n- CVE-2026-86144: propagate the document parse flags in xmlXIncludeProcess and xmlXIncludeProcessTree","status":"published","published":"2026-09-19T01:16:44Z","modified":"2026-10-26T09:30:56.266772386Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"MGASA-2026-0459","title":"Updated libxml2 packages fix security vulnerabilities","description":"The updated packages fix several security issues:\nStack-Based Buffer Overflow in libxml2. (CVE-2026-11979)\nIn libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds\nread, aka an out-of-bounds read in the NXT macro in xmlregexp.\n(CVE-2026-86137)\nIn libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer\noverflow and resultant heap-based buffer overflow. (CVE-2026-86138)\nIn libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer\noverflow. (CVE-2026-86139)\nIn libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat\nstack-based buffer overflow. (CVE-2026-86140)\nxmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in\nxmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate\na string length after NULL checking. (CVE-2026-86141)\nIn libxml2 before 2.15.4, there is a heap-based buffer overflow in\nxmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.\n(CVE-2026-86142)\nIn xmlIO in libxml2 before 2.15.4, an inconsistency in\nxmlOutputWriteCallback and xmlBufUse causes negative lengths to reach\nwrite callbacks, aka a lack of a check for integer overflow before\ncalling writecallback. This has security relevance for many types of\nuses of that length value within a callback. (CVE-2026-86143)\nIn xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and\nxmlXIncludeProcessTree do not propagate parseFlags. This has security\nrelevance for, for example, the XML_PARSE_NONET flag, if (without it) a\ncustom resource loader accesses the internet and triggers XML external\nentity injection, SSRF, or a denial of service (e.g., for an\nattacker-controlled internet resource that is intentionally slow).\n(CVE-2026-86144)\n","status":"published","published":"2026-09-28T17:04:04Z","modified":"2026-09-28T17:15:03.661029458Z","updated_at":"2026-11-02T15:49:43.795591Z"}]}}