CVE-2026-86143

Analyzed Analyzed - Analysis Complete

Integer Overflow in xmlIO via libxml2

Publication date: 2026-09-05

Last updated on: 2026-09-15

Assigner: MITRE

Description

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-05

Last Modified

2026-09-15

Generated

2026-09-25

AI Q&A

2026-09-05

EPSS Evaluated

2026-09-24

NVD

CVE-2026-86143

EUVD

EUVD-2026-71822

Affected Vendors & Products

Vendor	Product	Version / Range
xmlsoft	libxml2	to 2.15.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-192	Integer coercion refers to a set of flaws pertaining to the type casting, extension, or truncation of primitive data types.

Attack-Flow Graph

Executive Summary

This vulnerability in libxml2 before 2.15.4 involves an integer overflow issue in xmlIO where xmlOutputWriteCallback and xmlBufUse can pass negative lengths to write callbacks due to a lack of validation. This occurs because xmlOutputWriteCallback does not check for integer overflow before calling writecallback, which can lead to security issues when the length value is used within the callback.

Detection Guidance

To detect this vulnerability, check the version of libxml2 installed on your system. Compare it against version 2.15.4 or later. Use commands like 'xml2-config --version' or 'rpm -qa | grep libxml2' on Linux. If your version is older, the system is vulnerable.

Impact Analysis

This vulnerability could allow attackers to trigger undefined behavior or execute arbitrary code by exploiting the integer overflow to manipulate buffer sizes or lengths. This may lead to crashes, data corruption, or unauthorized access depending on how libxml2 is used in applications.

Compliance Impact

This vulnerability involves an integer overflow in libxml2's xmlIO component that could lead to undefined behavior or security issues during buffer operations. Such flaws may result in data corruption or unexpected program behavior, which could compromise the integrity of sensitive data processing. For compliance with standards like GDPR or HIPAA, which require strict data integrity and security controls, this vulnerability could pose risks if exploited to manipulate or corrupt data during processing or storage.

Mitigation Strategies

Update libxml2 to version 2.15.4 or later to address the integer overflow issue in xmlIO. Monitor for any applications using libxml2 that may require recompilation or configuration updates after the patch.

Hi! I’m here to help you understand CVE-2026-86143. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70