CVE-2026-86143
Received Received - Intake

Integer Overflow in xmlIO via libxml2

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: MITRE

Description
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-86143
EUVD
EUVD-2026-71822

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gnome libxml2 to 2.15.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-192 Integer coercion refers to a set of flaws pertaining to the type casting, extension, or truncation of primitive data types.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in libxml2 before 2.15.4 involves an integer overflow issue in xmlIO where xmlOutputWriteCallback and xmlBufUse can pass negative lengths to write callbacks due to a lack of validation. This occurs because xmlOutputWriteCallback does not check for integer overflow before calling writecallback, which can lead to security issues when the length value is used within the callback.

Impact Analysis

This vulnerability could allow attackers to trigger undefined behavior or execute arbitrary code by exploiting the integer overflow to manipulate buffer sizes or lengths. This may lead to crashes, data corruption, or unauthorized access depending on how libxml2 is used in applications.

Mitigation Strategies

Update libxml2 to version 2.15.4 or later to address the integer overflow issue in xmlIO. Monitor for any applications using libxml2 that may require recompilation or configuration updates after the patch.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86143. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart