The vulnerability is a stack-based buffer overflow in the xmlcatalog utility of libxml2, triggered when the tool runs in --shell mode and processes overly long input lines. The unbounded input handling can corrupt stack buffers used for command, argument, and argv data, potentially causing the process to crash or executing arbitrary code in the context of the xmlcatalog process.

Vendors: xmlsoft. Product: libxml2. No specific affected version information is provided; the issue was fixed in a recent commit (c2e233fc).

The CVSS score of 1.8 indicates low severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local: an attacker who can run xmlcatalog with the --shell option and supply crafted input may trigger the overflow. Successful exploitation could lead to code execution with the permissions of the xmlcatalog process, but the impact is limited to the local user context and is unlikely to be remotely exploitable without additional factors.