CVE-2026-86137

CVE-2026-86137 is an out-of-bounds read (CWE-125) in libxml2's xmlFAParsePosCharGroup function, in the NXT macro of the xmlregexp regular-expression engine, fixed in libxml2 2.15.4. It is triggered when an application uses libxml2 to parse a regular-expression pattern that reaches the character-group parsing code path; the high-complexity CVSS component indicates a carefully formed input is needed to reach the faulty read. The practical impact is minimal: the vector is local (AV:L) with no confidentiality or integrity impact and only limited availability loss, so the realistic worst case is a crash or partial disruption of the parsing process rather than code execution or data disclosure. Any software that ships, links, or bundles a version of libxml2 prior to 2.15.4 is affected, which includes a very large installed base given how widely the library is embedded. Exploitation status is quiet: there is no public proof of concept, the flaw is not in CISA's KEV, and EPSS puts exploitation probability at 0.1% over the next 30 days.

What to do: Upgrade to libxml2 2.15.4 or later; because libxml2 is frequently bundled rather than dynamically linked, also apply updated distro packages and refresh or rebuild dependencies that vendor their own copy, such as language bindings and statically linked applications. Given the low severity (CVSS 2.9) and absence of known exploitation, this can be handled in regular patch cycles rather than emergency remediation.