CVE-2026-123202: libnxml before 0.18.6 Stack-based Buffer Overflow via long multi-byte XML name
libnxml before 0.18.6 contains a stack-based buffer overflow vulnerability in src/nxmlparser.c that allows remote attackers to write past a 1024-byte stack buffer via long XML names. Attackers can supply XML or RSS feeds with a 1022-character element, attribute, DOCTYPE or entity name ending in a multi-byte UTF-8 character to crash parsing applications.
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using libnxml versions before 0.18.6 are exposed when they parse attacker-controlled XML or RSS content. The affected parser can be reached through XML names used for elements, attributes, DOCTYPE declarations, or entities.
What input is required to trigger the overflow?
An attacker must provide XML or an RSS feed containing a 1022-character name that ends with a multi-byte UTF-8 character. No authentication or user interaction is required according to the supplied severity vector.
What is the known impact of successful exploitation?
The provided data states that the overflow can crash applications while parsing the crafted content, resulting in a denial of service. No confidentiality or integrity impact is indicated by the supplied severity vector.
What should teams do to remediate the issue?
Upgrade libnxml to version 0.18.6 or later. If upgrading cannot happen immediately, avoid parsing untrusted XML or RSS input with affected versions.