In libxml2 before version 2.15.4, an inconsistency between xmlOutputWriteCallback and xmlBufUse allows negative lengths to be passed to write callbacks. The flaw is a lack of integer overflow validation and is classified as CWE‑192. This can result in undefined behavior when the callback processes the length value, making the library’s behavior potentially unsafe if untrusted data is involved.

The vulnerability affects all releases of the libxml2 library from xmlsoft that are older than version 2.15.4. Applications and distributions that ship these older releases are consequently exposed.

The CVSS score of 6.9 marks the issue as moderate severity. An EPSS score of < 1% indicates a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, indicating limited or unknown exploitation activity. The attack vector is inferred to be local or remote, depending on the ability to provide crafted input that triggers the callback. Exploitation requires the application to invoke the write callback with a negative length, and the impact would depend on how the callback interprets the length value.