USN-8910-1: libxml2 vulnerabilities

A NULL pointer dereference (CWE-476) in libxml2 is triggered when an XML catalog contains a nextCatalog element that omits its mandatory catalog attribute. A local user, or an attacker who can supply a specially crafted XML catalog, can crash the application during catalog parsing and cause a denial of service. Impact is limited to availability: CVSS 3.1 is 5.5 (medium), with a local attack vector, no privileges required, and user interaction required. The library is widely packaged, including by Red Hat (the assigning CNA) and Ubuntu (USN-8910-1), so any system or application that parses XML catalogs may be affected. No public proof of concept is known and the flaw is not in the CISA KEV catalog.

Do: Install the libxml2 update from your operating-system or application vendor as soon as it is available (Ubuntu tracks this in USN-8910-1; Red Hat is the CNA and other distributors should ship corresponding packages). Until patched builds are in place, do not process untrusted or user-supplied XML catalogs, and restrict who can provide catalog files to applications that load them.

CVE-2026-86138 is an integer overflow (CWE-190) in xmlDictAddQString in dict.c of libxml2, the widely used XML parsing library; the miscalculated size calculation leads to a heap-based buffer overflow. It is triggered when an application built on an affected libxml2 processes crafted XML (or other structured input) that exercises the library's qualified-string dictionary handling in a way that makes a computed length wrap around, producing an undersized allocation and an out-of-bounds heap write; the CVSS vector (AV:L/AC:H) indicates the attack path requires local access or locally processed crafted input and that exploitation conditions are narrow. An attacker who triggers the bug gains heap memory corruption with the privileges of the affected process, with high confidentiality and integrity impact and low availability impact per the CVSS score, ranging from crashes to potentially limited code execution. Anyone deploying or embedding libxml2 versions before 2.15.4 is affected, which spans a very large share of Linux/Unix systems, language runtimes, and applications that parse XML. There is currently no public proof-of-concept, no CISA KEV listing, and a 0.1% EPSS score, indicating no known exploitation.

Do: Upgrade to libxml2 2.15.4 or later if you build libxml2 directly, or install your Linux distribution's updated libxml2 package and restart dependent applications so the patched library is loaded. Audit which systems and services link or embed libxml2 (e.g., via package manager dependency queries) and prioritize patching services that parse untrusted XML. With no public PoC, no KEV listing, and very low EPSS, this can be handled in normal patch cycles, but it should not be deferred indefinitely since heap overflows in a universally deployed parser are prime exploitation targets once details circulate.