NULL Pointer Dereference in libxml2 Affects GNOME Products
CVE-2026-86141

2.9LOW

Key Information:

Vendor

Xmlsoft

Status
Libxml2
Vendor
CVE Published:
5 September 2026

What is CVE-2026-86141?

A security vulnerability exists in xmlregexp within libxml2 prior to version 2.15.4, where a NULL pointer dereference occurs in the xmlRegNewParserCtxt function following a strdup failure. The defect arises from not calculating the length of a string after performing a NULL check, potentially leading to system instability or compromised application behavior.

Affected Version(s)

libxml2 0 < 2.15.4

References

https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4
https://github.com/GNOME/libxml2/commit/e89a8aae4c9b40cda...
https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1107

CVSS V3.1

Score:
2.9
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.