Critical Security Flaw in libxml2: Heap and Stack Buffer Overflows
Summary
ALSA-2026:71585: Important: libxml2 security update. Affects libxml2 versions < 2.9.13-14.el9_8.5. Fixed in 2.9.13-14.el9_8.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxml2 is a widely used library that provides tools for parsing and manipulating XML documents. It supports various XML standards and is essential for many applications that require XML processing. However, recent vulnerabilities have been identified that could lead to severe security issues, including arbitrary code execution and data integrity problems.
Vulnerability Detail
The vulnerabilities in libxml2 stem from multiple issues, including heap-based and stack-based buffer overflows, which can allow attackers to execute arbitrary code. Specifically, CVE-2026-86138 and CVE-2026-86140 detail how these overflows can be exploited, while CVE-2026-86143 highlights data integrity issues due to integer overflow. Additionally, improper handling of parseFlags can lead to information disclosure or denial of service (CVE-2026-86144). The Python bindings also exhibit a double-free vulnerability (CVE-2026-74860), further complicating the security landscape of this library.
How To Fix
Minimum fixed version
2.9.13-14.el9_8.5
This is the first release that contains the fix.
sudo dnf update libxml2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation and sanitization to mitigate the risk of exploitation. Additionally, avoid using the affected features of libxml2 until the update can be applied.
Conclusion
The vulnerabilities in libxml2 pose significant security risks, including arbitrary code execution and data integrity issues. It is essential to update to the patched version to mitigate these risks effectively. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for libxml2 →
FAQ
libxml2 is a development library used for parsing and manipulating XML documents, widely utilized in various software applications.
The vulnerabilities include heap-based and stack-based buffer overflows, integer overflows, and improper handling of parseFlags, leading to potential arbitrary code execution and data integrity issues.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json. Visit Vulert Scanner to check your application without needing to sign up.
Implement input validation and avoid using the vulnerable features of libxml2 until you can apply the necessary updates.
Detailed information about the vulnerabilities can be found on the CVE pages listed in the advisory, including CVE-2026-74860 and CVE-2026-86144.
Related vulnerabilities
Recent vulnerabilities recorded for libxml2.
