Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
libxml2 can overflow memory when handling XML names
published 1 month ago
Summary
The libxml2 library used for processing XML files can write beyond its allocated memory if specially crafted element or attribute names are processed. This could allow an attacker to crash the application or potentially execute code. Apply the latest security update from your Linux distribution to fix the issue.
What to do
- Update canonical libxml2 to version 2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els11.
- Update canonical libxml2-dev to version 2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els11.
- Update canonical libxml2-doc to version 2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els11.
- Update canonical libxml2-utils to version 2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els11.
- Update canonical python-libxml2 to version 2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els11.
- Update canonical python3-libxml2 to version 2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els11.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Ubuntu:18.04 | canonical | libxml2 |
< 2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els11 Fix: upgrade to 2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els11
|
| TuxCare:Ubuntu:18.04 | canonical | libxml2-dev |
< 2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els11 Fix: upgrade to 2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els11
|
| TuxCare:Ubuntu:18.04 | canonical | libxml2-doc |
< 2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els11 Fix: upgrade to 2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els11
|
| TuxCare:Ubuntu:18.04 | canonical | libxml2-utils |
< 2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els11 Fix: upgrade to 2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els11
|
| TuxCare:Ubuntu:18.04 | canonical | python-libxml2 |
< 2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els11 Fix: upgrade to 2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els11
|
| TuxCare:Ubuntu:18.04 | canonical | python3-libxml2 |
< 2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els11 Fix: upgrade to 2.9.4+dfsg1-6.1ubuntu1.9+tuxcare.els11
|
Original advisory text
Fix CVE(s): CVE-2026-86138
* SECURITY UPDATE: heap buffer overflow in the XML dictionary QName
interning path
- debian/patches/CVE-2026-86138.patch: Add integer overflow checks to the
pool size calculation in xmlDictAddQString() in dict.c, and cap the
prefix and name lengths in xmlDictQLookup() so the sum namelen + plen + 1
cannot wrap and undersize the pool allocation
- CVE-2026-86138
interning path
- debian/patches/CVE-2026-86138.patch: Add integer overflow checks to the
pool size calculation in xmlDictAddQString() in dict.c, and cap the
prefix and name lengths in xmlDictQLookup() so the sum namelen + plen + 1
cannot wrap and undersize the pool allocation
- CVE-2026-86138
References
- https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1789744484.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-86138 Vendor Advisory
Timeline
Published18 Sep 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1789744484 · OSV
Track software like this
Free during beta