← All advisories

Medium severity6.9NVD Advisory· Published Sep 5, 2026· Updated Sep 15, 2026

CVE-2026-86138

CVE-2026-86138

Description

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.

Affected products

5

GNOME Foundation/Libxml2llm-fuzzy
Range: <2.15.4
osv-coords4 versions
pkg:rpm/almalinux/libxml2 pkg:rpm/almalinux/libxml2-devel pkg:rpm/almalinux/libxml2-static pkg:rpm/almalinux/python3-libxml2
< 2.9.13-14.el9_8.5+ 3 more
- (no CPE)range: < 2.9.13-14.el9_8.5
- (no CPE)range: < 2.9.13-14.el9_8.5
- (no CPE)range: < 2.12.5-10.el10_2.4
- (no CPE)range: < 2.9.13-14.el9_8.5

Patches

Vulnerability mechanics

References

2

github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4nvdPatch
github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4nvdRelease Notes

News mentions

0

No linked articles in our index yet.