CVE-2026-86139

libxml2 before 2.15.4 contains an integer overflow in the xmlURIEscapeStr function within uri.c. The upstream fix (commit 8edbbdb0) adds a zero-length guard after xmlStrlen to catch cases where the function returns 0 for a non-empty input, preventing the overflow. According to Red Hat, the flaw c...

CVE-2026-86139

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow...

EUVD-2026-71832

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow...

CVE-2026-86139

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow...

CVE-2026-86139

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the xmlURIEscapeStr function. An attacker can execute arbitrary code or access sensitive information by triggering an integer overflow that results in memory corruption. Remediation Upgrade libxml2 to...

CVE-2026-86138

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow...

CVE-2026-86138

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow...

CVE-2026-86138

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow...

EUVD-2026-71831

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow...

CVE-2026-86138

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow...

CVE-2026-86138

CVE-2026-86138 affects libxml2 before version 2.15.4 . The root cause is an integer overflow in the xmlDictAddQString function (dict.c), which results in a heap-based buffer overflow . A local attacker can leverage this to execute arbitrary code , compromising system integrity and confidentiality...

CVE-2026-86138

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow...

CVE-2026-86138

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the xmlDictAddQString function in dict.c due to an integer overflow that leads to a heap-based buffer overflow. An attacker can execute arbitrary code by supplying specially crafted input that triggers the overflo...

[slackware-security] libxml2

New libxml2 packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/libxml2-2.11.9-i586-10slack15.0.txz: Rebuilt. This update fixes bugs and security issues: xmlregexp: Prevent out-of-bounds read in NX...

SUSE CVE-2026-54345

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fixed header size from an attacker-controlled AVP Length field, so a vendor-flagged AVP whose Length is smaller than the 12-byte header...

SUSE CVE-2026-71479

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, maxtokens, maxcompletiontokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversio...

SUSE CVE-2026-73564

frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bound...

SUSE CVE-2026-80810

In the Linux kernel, the following vulnerability has been resolved: iouring/rsrc: fix folio size overflow in iovecfillbvec iovecfillbvec computes the folio size with a plain int 1: unsigned long foliosize = 1 folioshift; imu-folioshift is unsigned int and comes from folioshift of the folio backin...