CVE-2026-86142: Medium Heap Overflow in libxml2 XPointer Evaluation

CVE-2026-86142 is a medium severity heap based buffer overflow in libxml2 before 2.15.4. In xmlXPtrEvalXPtrPart, the XPointer length calculation saturates, so a buffer is sized too small. Upgrade to libxml2 2.15.4 or a distribution package that carries the upstream fix.

What's affected

Affected: libxml2 before 2.15.4. The flaw is in xmlXPtrEvalXPtrPart in xpointer.c, part of XPointer expression evaluation. Upstream tracks it as work item 1113 on its GitLab.

Upstream's fixed release is libxml2 2.15.4. The record says "before 2.15.4", and the comparison between v2.15.3 and v2.15.4 spans 39 commits. The record does not list this CVE in CISA KEV, and I found no statement of exploitation in the pages I reviewed.

How to check if you're exposed

libxml2 reaches you in three ways: as a system package, as a library bundled inside another product, and as a copy statically linked into a language binding.

For the system library and command line tool:

xmllint --version
dpkg -l libxml2          # Debian and Ubuntu
rpm -q libxml2           # RHEL, Fedora, SUSE

For Python's lxml, which can bundle its own libxml2:

python -c "from lxml import etree; print(etree.LIBXML_VERSION)"

Anything reporting a version below 2.15.4 is in range upstream. Linux distributions often backport fixes without changing the version number, so also check your distribution's security tracker for this CVE. Container images and vendored copies need an SBOM or image scan, since the version is not visible from the host.

What to do now

1. Inventory where libxml2 runs: host packages, container images, and language packages that bundle it.
2. Upgrade to libxml2 2.15.4 or later, or install your distribution package that lists this CVE as fixed.
3. Rebuild and redeploy container images and statically linked binaries, since upgrading the host package does not touch them.
4. Until patched, avoid feeding untrusted XML, URIs or XPointer expressions of unusual size to services that use libxml2.
5. Run a dependency scan to catch copies you did not know about. Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan that lists the package versions a project pulls in, which is a quick way to see whether an affected release is in your tree. Reachability analysis can then help you judge whether the vulnerable code path is actually used.

Why it matters

The fix adds a check for overflow in xmlStrlen. Per the commit, when the string length helper returns 0 even though the string is not empty, the code now reports a memory error, frees the name it holds, and returns. Before the fix, the code added one to the saturated length and allocated a buffer from it, which was too small for the data that followed.

The weakness is CWE-122, heap based buffer overflow. As with the other length based bugs in this group, the trigger involves a string beyond the range of a signed int, so ordinary XPointer expressions are not the concern.

XPointer is a niche feature. If your code never evaluates XPointer expressions from untrusted sources, your exposure is lower. Still, the library is shared across many applications, and the upgrade is routine, so fold it into the 2.15.4 update.

Quick check

Sources

• libxml2 fix commit
• libxml2 comparison v2.15.3 to v2.15.4
• libxml2 GitLab work item 1113
• Safeguard Gold entry for CVE-2026-86142

Last reviewed: 18 October 2026.