AI analysis
CVE-2026-86137 is an out-of-bounds read (CWE-125) in libxml2's xmlFAParsePosCharGroup function, in the NXT macro of the xmlregexp regular-expression engine, fixed in libxml2 2.15.4. It is triggered when an application uses libxml2 to parse a regular-expression pattern that reaches the character-group parsing code path; the high-complexity CVSS component indicates a carefully formed input is needed to reach the faulty read. The practical impact is minimal: the vector is local (AV:L) with no confidentiality or integrity impact and only limited availability loss, so the realistic worst case is a crash or partial disruption of the parsing process rather than code execution or data disclosure. Any software that ships, links, or bundles a version of libxml2 prior to 2.15.4 is affected, which includes a very large installed base given how widely the library is embedded. Exploitation status is quiet: there is no public proof of concept, the flaw is not in CISA's KEV, and EPSS puts exploitation probability at 0.1% over the next 30 days.
What to do: Upgrade to libxml2 2.15.4 or later; because libxml2 is frequently bundled rather than dynamically linked, also apply updated distro packages and refresh or rebuild dependencies that vendor their own copy, such as language bindings and statically linked applications. Given the low severity (CVSS 2.9) and absence of known exploitation, this can be handled in regular patch cycles rather than emergency remediation.
Affected
| GNOME (libxml2 project) libxml2 | all versions prior to 2.15.4 |
Estimated exposure
masshundreds of millions to billions of installations (libxml2 ships by default in virtually every Linux distribution and is embedded in countless applications and… — The estimate reflects libxml2's role as the default or dependency XML parser across Linux distributions, macOS, and many bundled applications, though practical risk is tempered by the bug's local attack vector and low availability-only…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.