libxml2 2.15.4 fixes xmlDictAddQString heap-buffer-overflow flaw (CVE-2026-86137, CVE-2026-86138) and several overflow/parsing bugs
libxml2 2.15.4, released September 1, 2026, fixes an integer overflow in xmlDictAddQString (dict.c) that leads to a heap-based buffer overflow, tracked as CVE-2026-86137 and CVE-2026-86138, plus an out-of-bounds read in xmlregexp and multiple other overflow…
libxml2 2.15.4 was released on September 1, 2026 with a batch of security fixes, announced on oss-security on 2026-09-04. Per the release announcement, the fixes include an out-of-bounds read in the xmlregexp NXT macro; missing overflow checks added in dict.c, uri.c, and valid.c; an integer overflow fix in xmlIO before the writecallback; an added overflow check in xmlXPtrEvalXPtrPart; and corrected propagation of parseFlags in xmlXIncludeProcess and xmlXIncludeProcessTree. The original announcement gave no CVE identifiers, severity ratings, or exploitation details. A follow-up oss-security post on 2026-09-05 by Debian's Salvatore Bonaccorso adds CVE tracking: libxml2 releases before 2.15.4 are affected by an integer overflow in xmlDictAddQString in dict.c that leads to a heap-based buffer overflow, tracked as CVE-2026-86137 and CVE-2026-86138 (the post assigns both identifiers to this issue without distinguishing them). The two posts are consistent rather than conflicting: the follow-up's dict.c issue corresponds to the overflow checks the 2.15.4 release added in dict.c. Neither post reports any exploitation or assigns severity ratings, and no exploit code is provided.
- libxml2 2.15.4 released September 1, 2026 with security fixes
- libxml2 releases before 2.15.4 are affected by an integer overflow in xmlDictAddQString (dict.c) that leads to a heap-based buffer overflow (per the follow-up post)
- CVE-2026-86137 and CVE-2026-86138 assigned to the xmlDictAddQString issue per the follow-up post; the original announcement listed no CVE identifiers
- Out-of-bounds read in the xmlregexp NXT macro fixed in 2.15.4
- Missing overflow checks added in dict.c, uri.c, and valid.c
- Integer overflow in xmlIO before the writecallback fixed; overflow check added in xmlXPtrEvalXPtrPart
- parseFlags propagation fixed in xmlXIncludeProcess and xmlXIncludeProcessTree
- No exploitation reported in either post; no severity ratings provided in either post
Coverage timelineoldest first · each row is one article
- · 11d agoVulnerabilities fixed in libxml2-2.15.4
oss-security· 28
libxml2 2.15.4 fixes an out-of-bounds read in xmlregexp's NXT macro plus several integer overflow and parsing flaws.
Vulnerabilities in this storyAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-86138 +1 in the same advisory: …86137 | Heap Buffer Overflow via Integer Overflow in libxml2 before 2.15.4 CVE-2026-86138 is an integer overflow (CWE-190) in xmlDictAddQString in dict.c of libxml2, the widely used XML parsing library; the miscalculated size calculation leads to a heap-based buffer overflow. It is triggered when an application built on an affected libxml2 processes crafted XML (or other structured input) that exercises the library's qualified-string dictionary handling in a way that makes a computed length wrap around, producing an undersized allocation and an out-of-bounds heap write; the CVSS vector (AV:L/AC:H) indicates the attack path requires local access or locally processed crafted input and that exploitation conditions are narrow. An attacker who triggers the bug gains heap memory corruption with the privileges of the affected process, with high confidentiality and integrity impact and low availability impact per the CVSS score, ranging from crashes to potentially limited code execution. Anyone deploying or embedding libxml2 versions before 2.15.4 is affected, which spans a very large share of Linux/Unix systems, language runtimes, and applications that parse XML. There is currently no public proof-of-concept, no CISA KEV listing, and a 0.1% EPSS score, indicating no known exploitation. Do: Upgrade to libxml2 2.15.4 or later if you build libxml2 directly, or install your Linux distribution's updated libxml2 package and restart dependent applications so the patched library is loaded. Audit which systems and services link or embed libxml2 (e.g., via package manager dependency queries) and prioritize patching services that parse untrusted XML. With no public PoC, no KEV listing, and very low EPSS, this can be handled in normal patch cycles, but it should not be deferred indefinitely since heap overflows in a universally deployed parser are prime exploitation targets once details circulate. | 7.8 group max | <1% |
| mass≈100M+ installations (libxml2 ships as a default system library on virtually every Linux/Unix system and is embedded in countless applications, language… |