Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

Re: Vulnerabilities fixed in libxml2-2.15.4

oss-security ()3 · 2 reads
Read at seclists.org
AI summary · glm-5.3-flashSummaries by Vani AI

libxml2 2.15.4 patches two flaws including a heap buffer overflow in xmlDictAddQString tracked as CVE-2026-86137 and CVE-2026-86138.

libxml2 releases before 2.15.4 are affected by an integer overflow in xmlDictAddQString in dict.c that leads to a heap-based buffer overflow, tracked as CVE-2026-86137 and CVE-2026-86138. The oss-security post from Debian's Salvatore Bonaccorso flags the fixed release for downstream tracking. No exploitation is mentioned in the disclosure.

Key facts
  • Integer overflow in xmlDictAddQString causes heap-based buffer overflow
  • Fixed in libxml2 2.15.4
  • Two CVE identifiers assigned: CVE-2026-86137 and CVE-2026-86138
  • No evidence of exploitation stated
Analyze CVE-2026-86137 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-86137CVE-2026-86138
Tags
cveheap-overflowinteger-overflowlibxml2open-source
Vendors
libxml2
Products
libxml2
Organizations
Debian

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-86138
+1 related CVE
CVE-2026-86137
Heap Buffer Overflow via Integer Overflow in libxml2 before 2.15.4
7.8
group max
<1%

From the original article

Posted by Salvatore Bonaccorso on Sep 05 Hi, https://www. cve. org/CVERecord?

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.