CVE-2026-86139: Integer Overflow

Q: What conditions are required to exploit this issue?

The vulnerability is locally exploitable and has high attack complexity. The supplied vector indicates no privileges or user interaction are required.

Q: Which installations should be considered affected?

Installations using libxml2 before version 2.15.4 should be considered affected. The issue is in the xmlURIEscapeStr function in uri.c.

Q: What should teams do if they cannot update immediately?

The provided information does not identify a workaround or configuration mitigation. Prioritize upgrading libxml2 to version 2.15.4 or later when possible.

Published Sep 5, 2026

Updated

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.

Affected Software

1 affected component

libxml2 libxml2<2.15.4

Event History

Sep 5, 2026

CVE Published

via MITRE·04:23 AM

Data Sourced

via MITRE·04:23 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required to exploit this issue?

The vulnerability is locally exploitable and has high attack complexity. The supplied vector indicates no privileges or user interaction are required.

Which installations should be considered affected?

Installations using libxml2 before version 2.15.4 should be considered affected. The issue is in the xmlURIEscapeStr function in uri.c.

What should teams do if they cannot update immediately?