Medium severity6.9NVD Advisory· Published Sep 5, 2026· Updated Sep 15, 2026
CVE-2026-86143
CVE-2026-86143
Description
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
5- Range: <2.15.4
- osv-coords4 versionspkg:rpm/almalinux/libxml2-staticpkg:rpm/almalinux/libxml2pkg:rpm/almalinux/python3-libxml2pkg:rpm/almalinux/libxml2-devel
< 2.12.5-10.el10_2.4+ 3 more
- (no CPE)range: < 2.12.5-10.el10_2.4
- (no CPE)range: < 2.9.13-14.el9_8.5
- (no CPE)range: < 2.9.13-14.el9_8.5
- (no CPE)range: < 2.9.13-14.el9_8.5
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.