CVE-2026-123202 libnxml before 0.18.6 Stack-based Buffer Overflow via long multi-byte XML name

High 8.7 Published 5 Nov 2026 Updated 5 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-123202?

CVE-2026-123202 is a high-severity vulnerability in bakulf libnxml, published on 5 Nov 2026.

Official description

libnxml before 0.18.6 contains a stack-based buffer overflow vulnerability in src/nxml_parser.c that allows remote attackers to write past a 1024-byte stack buffer via long XML names. Attackers can supply XML or RSS feeds with a 1022-character element, attribute, DOCTYPE or entity name ending in a multi-byte UTF-8 character to crash parsing applications.

Weakness: CWE-121

Which versions are affected by CVE-2026-123202?

How do I fix CVE-2026-123202?

No fix has been published for CVE-2026-123202 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-123202 being exploited?

There is no known exploitation of CVE-2026-123202 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-123202, GHSA-mwvf-r58x-mh9m, UBUNTU-CVE-2026-123202.