Stack-Based Buffer Overflow in libnxml Affects Parsing Applications

CVE-2026-123202

What is CVE-2026-123202?

A stack-based buffer overflow vulnerability has been identified in libnxml prior to version 0.18.6. This security flaw arises from the handling of long XML names, allowing remote attackers to exploit parsing applications by supplying oversized XML or RSS feeds. Specifically, attackers can deliver a name that is 1022 characters long, ending with a multi-byte UTF-8 character, which can lead to write operations beyond the bounds of a 1024-byte stack buffer, ultimately causing the application to crash. Users are encouraged to upgrade to version 0.18.6 or later to mitigate this risk.

References