CVE-2026-86139

libxml2 versions before 2.15.4 contain an integer overflow (CWE-190) in the xmlURIEscapeStr function in uri.c, which is reached when the library escapes URI strings. An overly long input string passed through this code path can cause the length computation to wrap, potentially leading to heap corruption that an attacker could leverage for a crash or arbitrary code execution in the context of the process using the library. The CVSS 3.1 base score is 7.8 (high) with a local attack vector, low privileges required, and no user interaction, meaning exploitation requires the attacker to already run code or supply crafted input locally to an application that calls the affected function. Because libxml2 is a foundational XML parsing library embedded in operating systems and countless third-party applications, the vulnerable code is broadly deployed even though practical attack paths depend on how individual applications use xmlURIEscapeStr. There is no evidence of exploitation in the wild, no public proof of concept, the CVE is not in CISA's KEV catalog, and EPSS estimates only a 0.1% chance of exploitation in the next 30 days (1st percentile).

What to do: Upgrade libxml2 to version 2.15.4 or later; if you consume libxml2 through an OS distribution or a vendor product, apply the vendor's patched package rather than building from source. Inventory applications that parse or escape untrusted URI strings with libxml2 and prioritize patching those where untrusted input can reach xmlURIEscapeStr. Monitor advisories from your Linux distribution and application vendors for downstream fixes, and watch for crashes or memory-corruption anomalies in XML/URI-processing code paths as an indicator of attempted exploitation.