CVE-2026-123202

Received Received - Intake

Stack-Based Buffer Overflow in libnxml XML Parser

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: VulnCheck

Description

libnxml before 0.18.6 contains a stack-based buffer overflow vulnerability in src/nxml_parser.c that allows remote attackers to write past a 1024-byte stack buffer via long XML names. Attackers can supply XML or RSS feeds with a 1022-character element, attribute, DOCTYPE or entity name ending in a multi-byte UTF-8 character to crash parsing applications.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-05

Last Modified

2026-11-05

Generated

2026-11-06

AI Q&A

2026-11-06

EPSS Evaluated

N/A

NVD

CVE-2026-123202

EUVD

EUVD-2026-117647

Affected Vendors & Products

Vendor	Product	Version / Range
bakulf	libnxml	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

This vulnerability is a stack-based buffer overflow in libnxml before version 0.18.6. It occurs when parsing long multi-byte XML names like elements, attributes, DOCTYPE, or entity names. Attackers can exploit it by providing XML or RSS feeds with a 1022-character name ending in a multi-byte UTF-8 character, causing the application to crash.

Detection Guidance

To detect this vulnerability, inspect systems using libnxml versions before 0.18.6. Check XML/RSS feeds for unusually long element, attribute, DOCTYPE, or entity names exceeding 1022 characters. Use commands like 'grep -r "libnxml" /usr/local/lib' or 'ldd /path/to/binary | grep nxml' to identify affected applications.

Impact Analysis

This vulnerability allows remote attackers to crash applications using libnxml by sending maliciously crafted XML or RSS feeds. This could lead to denial-of-service conditions, application instability, or potential arbitrary code execution depending on the application's context and memory management.

Mitigation Strategies

Immediately update libnxml to version 0.18.6 or later. Apply the patch from commit fbac242374883edf2ec14127ca6d2accf4704b6a. Disable or restrict parsing of untrusted XML/RSS feeds until patched. Monitor for crashes in XML parsing applications.

Hi! I’m here to help you understand CVE-2026-123202. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...