CVE-2026-86143

libxml2 versions before 2.15.4 contain an integer overflow flaw in the xmlIO component. An inconsistency between xmlOutputWriteCallback and xmlBufUse allows negative lengths to reach write callbacks due to a missing overflow check before invoking the callback. The security impact depends on how t...