CVE-2026-86138 is a medium severity integer overflow in libxml2 before 2.15.4. In xmlDictAddQString (dict.c), a size calculation can wrap around, producing a small allocation and then a heap based buffer overflow. The fix is libxml2 2.15.4 or a distribution package that backports the commit.
What's affected
Affected: libxml2 before 2.15.4, including every earlier 2.x release the record covers. The vulnerable function is xmlDictAddQString in dict.c, part of the string dictionary the parser uses to intern names.
Upstream's fixed release is libxml2 2.15.4. The record says "before 2.15.4", and the comparison between v2.15.3 and v2.15.4 spans 39 commits. The record does not list this CVE in CISA KEV, and I found no statement of exploitation in the pages I reviewed.
How to check if you're exposed
libxml2 reaches you in three ways: as a system package, as a library bundled inside another product, and as a copy statically linked into a language binding.
For the system library and command line tool:
xmllint --version
dpkg -l libxml2 # Debian and Ubuntu
rpm -q libxml2 # RHEL, Fedora, SUSE
For Python's lxml, which can bundle its own libxml2:
python -c "from lxml import etree; print(etree.LIBXML_VERSION)"
Anything reporting a version below 2.15.4 is in range upstream. Linux distributions often backport fixes without changing the version number, so also check your distribution's security tracker for this CVE. Container images and vendored copies need an SBOM or image scan, since the version is not visible from the host.
What to do now
- Inventory where libxml2 runs: host packages, container images, and language packages that bundle it.
- Upgrade to libxml2 2.15.4 or later, or install your distribution package that lists this CVE as fixed.
- Rebuild and redeploy container images and statically linked binaries, since upgrading the host package does not touch them.
- Until patched, avoid feeding untrusted XML, URIs or XPointer expressions of unusual size to services that use libxml2.
- Run a dependency scan to catch copies you did not know about. Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan that lists the package versions a project pulls in, which is a quick way to see whether an affected release is in your tree. Reachability analysis can then help you judge whether the vulnerable code path is actually used.
Why it matters
The upstream commit message explains the cause plainly. The sibling function xmlDictAddString already had overflow guards for its pool size calculations, but xmlDictAddQString had none. The sum of the name length, prefix length and one more byte could overflow an unsigned int. Multiplying that overflowed value by four then produced a small allocation, and copying the prefix and name wrote past the end of it.
That is the weakness class CWE-190, integer overflow or wraparound, with a heap overflow as the consequence. The fix adds the same SIZE_MAX based guards the sibling function used, plus a safe cast to size_t. It is a good example of a bug found by comparing two near identical functions, where one got the safety check and one did not.
Memory corruption in an XML parser is worth taking seriously because the parser often sits behind network facing code. The record rates it Medium, so use that to order your work, but do not leave it unpatched in components that parse untrusted documents.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this fixed in 2.15.4?
The record says libxml2 before 2.15.4 is affected, and the fix commit sits in the 2.15.3 to 2.15.4 range. Confirm against your distribution if it backports.
Does it need a very large input?
The commit message describes an addition that overflows an unsigned integer. It does not give a size, so do not assume small inputs are safe.
Sources
Last reviewed: 18 October 2026.
