Integer Overflow Vulnerability in libxml2 Affects GNOME Products
CVE-2026-86139

6.9MEDIUM

Key Information:

Vendor

Xmlsoft

Status
Libxml2
Vendor
CVE Published:
5 September 2026

What is CVE-2026-86139?

An integer overflow vulnerability has been identified in the libxml2 library prior to version 2.15.4. This weakness is found in the xmlURIEscapeStr function within uri.c, which could lead to unexpected behavior and potential security risks. Users of affected versions are advised to upgrade to the latest version to mitigate the threat.

Affected Version(s)

libxml2 0 < 2.15.4

References

https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4
https://github.com/GNOME/libxml2/commit/8edbbdb09f24d26a2...

CVSS V3.1

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.