CVE-2026-86143

libxml2 before 2.15.4 contains an integer overflow flaw (CWE-192) in the xmlIO output path, where an inconsistency between xmlOutputWriteCallback and xmlBufUse allows a negative length value to be passed to write callbacks because no overflow check is performed before the call. The issue is triggered when an application serializes or writes an XML document whose output buffer length overflows the integer type, typically requiring crafted or extremely large input processed by a program using libxml2's output APIs. Because many consumers use that length value inside callbacks (e.g., as an unsigned size for write operations), a negative length can be coerced into a very large value, enabling out-of-bounds reads or writes and potential memory corruption or information disclosure within the affected application's context. The CVSS 3.1 base score of 7.3 (AV:L/PR:L) reflects a local, low-privilege attack with high confidentiality and integrity impact, meaning exploitation generally requires local access or control over input to a vulnerable host-side application. No exploitation in the wild has been observed, EPSS is very low (0.1%, 2nd percentile), and the issue is not in the CISA KEV catalog, though a public reference exists on the libxml2 GitLab tracker.

What to do: Upgrade libxml2 to version 2.15.4 or later, and for OS-managed installs apply distribution security updates as they become available. Audit first-party and third-party code that registers custom xmlOutputWriteCallback handlers to ensure it validates length arguments (rejecting negative values) before using them as sizes. Since practical impact depends on how individual applications use the callback length, prioritize reviewing locally run, input-processing applications that link vulnerable libxml2 versions.