CVE-2026-86140

libxml2 versions before 2.15.4 contain a stack-based buffer overflow (CWE-121) in xmlSnprintfElements in valid.c, where unbounded strcat calls are used while building DTD validation error messages that enumerate an element's child elements. The flaw is triggered when a vulnerable application processes an XML document that fails DTD validation and whose error-description output exceeds the fixed-size stack buffer, such as a document with many or long child element names. Successful exploitation can corrupt the process stack, potentially crashing the application or enabling code execution with the privileges of the parsing process, consistent with the CVSS 3.1 score of 8 (high) reflecting high confidentiality and integrity impact and a local attack vector. Any application, service, or system linking a vulnerable libxml2 and performing DTD validation of untrusted XML is affected, which spans a large share of the software ecosystem given libxml2's role as a ubiquitous XML parsing library. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS currently estimates only a 0.1% probability of exploitation within 30 days.

What to do: Upgrade libxml2 to 2.15.4 or later, or install updated libxml2 packages from your operating system or application vendor as they become available. Inventory applications and services linked against libxml2 and determine whether any of them perform DTD validation on untrusted XML input. As an interim mitigation, restrict or disable DTD validation of untrusted documents until patched.