CVE-2026-86142

CVE-2026-86142 is a heap-based buffer overflow in libxml2 before 2.15.4 , triggered in the xmlXPtrEvalXPtrPart function. The root cause is an integer overflow (xpointer length saturation) while processing an oversized xpointer() expression, leading to incorrect memory allocation and an out-of-bou...

CVE-2026-86139

libxml2 before 2.15.4 contains an integer overflow in the xmlURIEscapeStr function within uri.c. The upstream fix (commit 8edbbdb0) adds a zero-length guard after xmlStrlen to catch cases where the function returns 0 for a non-empty input, preventing the overflow. According to Red Hat, the flaw c...

CVE-2026-86143

libxml2 before 2.15.4 has an integer overflow in the xmlIO module. An inconsistency between xmlOutputWriteCallback and xmlBufUse causes negative length values to reach downstream write callbacks when data backlogs exceed maximum integer limits (approximately 2 GiB ). This can lead to data corrupt...

CVE-2026-86141

libxml2 versions before 2.15.4 contain a NULL pointer dereference in the xmlregexp module, specifically in the xmlRegNewParserCtxt function. The root cause is a missing string length calculation after a strdup failure and NULL check, leading to a potential crash. The CVSS 3.1 score is 2.9 (Low) w...