CVE-2026-86138

CVE-2026-86138 is an integer overflow (CWE-190) in xmlDictAddQString in dict.c of libxml2, the widely used XML parsing library; the miscalculated size calculation leads to a heap-based buffer overflow. It is triggered when an application built on an affected libxml2 processes crafted XML (or other structured input) that exercises the library's qualified-string dictionary handling in a way that makes a computed length wrap around, producing an undersized allocation and an out-of-bounds heap write; the CVSS vector (AV:L/AC:H) indicates the attack path requires local access or locally processed crafted input and that exploitation conditions are narrow. An attacker who triggers the bug gains heap memory corruption with the privileges of the affected process, with high confidentiality and integrity impact and low availability impact per the CVSS score, ranging from crashes to potentially limited code execution. Anyone deploying or embedding libxml2 versions before 2.15.4 is affected, which spans a very large share of Linux/Unix systems, language runtimes, and applications that parse XML. There is currently no public proof-of-concept, no CISA KEV listing, and a 0.1% EPSS score, indicating no known exploitation.

What to do: Upgrade to libxml2 2.15.4 or later if you build libxml2 directly, or install your Linux distribution's updated libxml2 package and restart dependent applications so the patched library is loaded. Audit which systems and services link or embed libxml2 (e.g., via package manager dependency queries) and prioritize patching services that parse untrusted XML. With no public PoC, no KEV listing, and very low EPSS, this can be handled in normal patch cycles, but it should not be deferred indefinitely since heap overflows in a universally deployed parser are prime exploitation targets once details circulate.