Description
In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
Published: 2026-09-05
Score: 8 High
EPSS: < 1% Very Low
KEV: No
Impact: Stack-based Buffer Overflow
Action: Immediate Patch
AI Analysis

Impact

The vulnerability in libxml2 prior to version 2.15.4 is a stack-based buffer overflow caused by an uncontrolled strcat in xmlSnprintfElements. This flaw may allow an attacker to corrupt memory, potentially enabling arbitrary code execution or denial‑of‑service. The weakness is classified as CWE‑120 and CWE‑121.

Affected Systems

The affected product is libxml2 from xmlsoft for all releases before 2.15.4. Users of any older libxml2 version are at risk.

Risk and Exploitability

The severity is CVSS 8, indicating a high impact. The EPSS score is 0.00136, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploitation has not been observed in the wild. The attack likely requires the ability to supply crafted XML input processed by the vulnerable library.

Generated by OpenCVE AI on September 8, 2026 at 02:11 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade libxml2 to version 2.15.4 or later.
  • If an immediate upgrade is not possible, apply the patch from commit d1686f91dbda141a752200419d35639fd6b38340 to fix xmlSnprintfElements.
  • Recompile any applications that depend on libxml2 against the updated library to ensure the fix takes effect.

Generated by OpenCVE AI on September 8, 2026 at 02:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 09 Sep 2026 09:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 08 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Title Stack-Based Buffer Overflow in libxml2's xmlSnprintfElements libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements
Weaknesses CWE-120
References
Metrics threat_severity

None

 threat_severity

Important

Sat, 05 Sep 2026 06:15:00 +0000

Type Values Removed Values Added
Title Stack-Based Buffer Overflow in libxml2's xmlSnprintfElements

Sat, 05 Sep 2026 04:45:00 +0000

Type Values Removed Values Added
Description In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
First Time appeared Xmlsoft
Xmlsoft libxml2
Weaknesses CWE-121
CPEs cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*
Vendors & Products Xmlsoft
Xmlsoft libxml2
References
Metrics cvssV3_1

{'score': 8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L'}

Subscriptions

Xmlsoft Libxml2
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-09-08T18:06:15.447Z

Reserved: 2026-09-05T04:26:13.510Z

Link: CVE-2026-86140

cve-icon Vulnrichment

Updated: 2026-09-08T18:06:10.755Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-05T05:17:12.877

Modified: 2026-09-15T19:39:17.010

Link: CVE-2026-86140

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-05T04:26:13Z

Links: CVE-2026-86140 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-08T02:15:08Z

Weaknesses
  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

  • CWE-121

    Stack-based Buffer Overflow