CVE-2026-86139: Integer Overflow
Published Sep 5, 2026
·Updated
In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.
Affected Software
3 affected componentsFixes available
libxml2 libxml2<2.15.4
Xmlsoft Libxml2<2.15.4
debian/libxml2<=2.12.7+dfsg+really2.9.14-2.1+deb13u3, <=2.12.7+dfsg+really2.9.14-2.1+deb13u1
2.9.14+dfsg-1.3~deb12u62.9.14+dfsg-1.3~deb12u42.15.4+dfsg-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libxml2to a version that resolves this vulnerability.Fixed in 2.9.14+dfsg-1.3~deb12u6Fixed in 2.9.14+dfsg-1.3~deb12u4Fixed in 2.15.4+dfsg-1 - Upgrade
Upgrade
libxml2to a version that resolves this vulnerability.Fixed in 2.15.4
Event History
Sep 5, 2026
CVE Published
via MITRE·04:23 AM
Data Sourced
via MITRE·04:23 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:17 AM
RemedyDescriptionSeverityWeaknessAffected Software
Sep 6, 2026
Data Sourced
via Microsoft·11:36 AM
DescriptionSeverityWeakness
Oct 8, 2026
Data Sourced
via Launchpad·08:52 PM
Description
Data Sourced
via Debian·08:52 PM
DescriptionAffected Software
Oct 9, 2026
Data Sourced
via Ubuntu·08:53 PM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What conditions are required to exploit this issue?
The vulnerability is locally exploitable and has high attack complexity. The supplied vector indicates no privileges or user interaction are required.
2
Which installations should be considered affected?
Installations using libxml2 before version 2.15.4 should be considered affected. The issue is in the xmlURIEscapeStr function in uri.c.
3
What should teams do if they cannot update immediately?
The provided information does not identify a workaround or configuration mitigation. Prioritize upgrading libxml2 to version 2.15.4 or later when possible.