CVE-2026-86138 Integer overflow in libxml2
An integer overflow in libxml2 leads to a heap-based buffer overflow, potentially allowing attackers to execute arbitrary code or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-86138?
CVE-2026-86138 is a medium-severity vulnerability in Xmlsoft Libxml2, published on 5 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.
Weakness: CWE-190
Which versions are affected by CVE-2026-86138?
It affects 1 product.
Products include Xmlsoft Libxml2.
How do I fix CVE-2026-86138?
Upgrade to a fixed version.
Is CVE-2026-86138 being exploited?
There is no known exploitation of CVE-2026-86138 in the wild and no public exploit code.
Other vulnerabilities in Xmlsoft Libxml2
Sources
Also known as AZL-99711, BELL-CVE-2026-86138, CLSA-2026-1789384426, CLSA-2026-1789463325, CLSA-2026-1789467963, CLSA-2026-1789470539 and 11 more.