CVE-2026-86143: Integer Overflow
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using libxml2 versions before 2.15.4 are affected. The issue is in xmlIO output handling and is relevant where a write callback receives the length value.
What access does an attacker need?
The supplied vector indicates local attack access, high attack complexity, and no required privileges or user interaction. The data does not identify a remote attack path.
How can I determine whether I need to remediate?
Check the deployed libxml2 version. Versions earlier than 2.15.4 should be treated as affected, particularly if the application uses xmlIO write callbacks.
What is the available remediation?
Update libxml2 to version 2.15.4 or later. The provided references identify the change between 2.15.3 and 2.15.4 and the associated fix commit.