Vulnerabilities fixed in libxml2-2.15.4
libxml2 2.15.4 fixes an out-of-bounds read in xmlregexp's NXT macro plus several integer overflow and parsing flaws.
libxml2 2.15.4 (released September 1, 2026) includes security fixes: an out-of-bounds read in the xmlregexp NXT macro, missing overflow checks in dict.c, uri.c, and valid.c, an integer overflow in xmlIO before the writecallback, and an overflow check in xmlXPtrEvalXPtrPart. The release also propagates parseFlags in xmlXIncludeProcess and xmlXIncludeProcessTree. No CVE identifiers, exploitation, or severity ratings are given in the announcement.
- Out-of-bounds read in xmlregexp NXT macro fixed
- Missing overflow checks added in dict.c, uri.c, and valid.c
- xpointer and xmlIO integer overflow checks added
- xinclude parseFlags propagation fixed in xmlXIncludeProcess and xmlXIncludeProcessTree
- Vendors
- GNOME/libxml2
- Products
- libxml2 2.15.4
From the original article
Posted by Sam James on Sep 04 From libxml2-2. 15. 4: +v2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.