7.3

CVE-2026-86143

Medienbericht
Exploit
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Xmlsoft ≫ Libxml2 Version < 2.15.4
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.12% 0.02
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.3 1.8 5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
MITRE 6.9 1.4 5.5
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CWE-192 Integer Coercion Error

Integer coercion refers to a set of flaws pertaining to the type casting, extension, or truncation of primitive data types.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
08.09.2026 20:38
https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4
Release Notes
https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35
Patch
https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111
Vendor Advisory
Exploit