In libxml2 versions prior to 2.15.4 the xmlDictAddQString function in dict.c contains an integer overflow that results in a heap-based buffer overflow. The overflow occurs when an internal buffer size is calculated without proper bounds checking, leading to memory writes beyond the allocated region. If an attacker can supply a crafted XML document that triggers this fault, the overflow can overwrite critical program data and potentially allow remote code execution. The weakness corresponds to CWE-190 (Arithmetic Overflow/Underflow) and manifests as a heap-based buffer overflow (CWE-787).

The affected product is libxml2 produced by the XMLSoft project. Any installation of libxml2 before release 2.15.4 is vulnerable. The security fix is bundled in v2.15.4 and later, so systems that depend on the library should verify their current version and upgrade if needed. All releases earlier than 2.15.4, including 2.15.3 and older major releases, lack the patch.

The CVSS score of 6.9 classifies the issue as medium severity. The EPSS score is < 1%, indicating a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in any CISA KEV catalog, which suggests that there has been no publicly documented exploitation at the time of this analysis. However, the nature of the overflow means that exploitation is theoretically feasible in any context where untrusted input can be parsed by libxml2, such as web servers, file processors, or embedded devices. Attackers would need to supply a crafted XML document that triggers the overflow, but the lack of a public proof of concept makes the practical risk uncertain. Given the medium CVSS score and potential for remote code execution, the vulnerability should be remediated promptly.