CVE-2026-86142

libxml2 versions before 2.15.4 contain a heap-based buffer overflow (CWE-122) in the xmlXPtrEvalXPtrPart function, caused by length saturation in xmlXPtrEval when processing XPointer expressions. The flaw is triggered when libxml2 evaluates a crafted, excessively long XPointer expression — typically via XInclude/XPointer processing of attacker-controlled XML input in an application that links the library. Successful exploitation can corrupt heap memory, causing a crash or potentially arbitrary code execution within the context of the parsing process; the CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L, high impact to confidentiality, integrity, and availability). Because libxml2 is one of the most widely deployed XML parsing libraries — bundled in Linux distributions, macOS, and countless applications and language runtimes — an enormous number of installations are technically in scope, though only those code paths that evaluate XPointer expressions on untrusted input are concretely exposed. No public proof-of-concept exists, the flaw is not in the CISA KEV catalog, and EPSS estimates only a 0.1% chance of exploitation in the next 30 days.

What to do: Upgrade libxml2 to 2.15.4 or later, or apply your Linux distribution's patched package (for example via apt/dnf/yum security updates) since most systems consume libxml2 through the OS. Identify applications that call XInclude or XPointer evaluation (xmlXPtrEval, xpointer handling) on untrusted XML documents, as these are the realistic attack surface. Until patched, restrict or sanitize XPointer expressions in untrusted XML input and monitor for crashes in XML-processing services as an indicator of attempted exploitation.