CVE-2026-86137
Received Received - Intake

Out-of-Bounds Read in libxml2

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: MITRE

Description
In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-86137
EUVD
EUVD-2026-71830

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gnome libxml2 to 2.15.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read in libxml2 before version 2.15.4. It occurs in the xmlFAParsePosCharGroup function due to an issue in the NXT macro within the xmlregexp component. The problem allows reading memory outside allocated bounds, which could lead to crashes or memory corruption.

Detection Guidance

Detecting this vulnerability requires checking the version of libxml2 installed on your system. Use the command 'xml2-config --version' to check the installed version. If it is below 2.15.4, the system is vulnerable. Additionally, monitor logs for crashes or memory corruption errors in applications using libxml2.

Impact Analysis

The impact is limited due to the low CVSS score (2.9). It may cause application crashes or instability when processing maliciously crafted XML input. However, it does not lead to code execution or data leaks.

Mitigation Strategies

Immediately update libxml2 to version 2.15.4 or later. This can be done using package managers like 'apt', 'yum', or 'dnf' depending on your system. For example, run 'sudo apt update && sudo apt upgrade libxml2' on Debian-based systems or 'sudo yum update libxml2' on RHEL-based systems.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86137. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart