CVE-2026-86140 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8 HIGH	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Base Score

CVSS 3.x

EPSS Score

Percentile: 4.42%

Affected Products (NVD)

Vendor	Product	Version
xmlsoft	libxml2	𝑥 < 2.15.4

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

libxml2

bookworm	postponed
bookworm (security)	vulnerable
forky	2.15.4+dfsg-1 fixed
sid	2.15.4+dfsg-1 fixed
trixie	vulnerable
trixie (security)	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

libxml2

bionic	Fixed 2.9.4+dfsg1-6.1ubuntu1.9+esm8 released
focal	Fixed 2.9.10+dfsg-5ubuntu0.20.04.10+esm5 released
jammy	Fixed 2.9.13+dfsg-1ubuntu0.13 released
noble	Fixed 2.9.14+dfsg-1.3ubuntu3.9 released
resolute	Fixed 2.15.2+dfsg-0.1ubuntu0.2 released
trusty	Fixed 2.9.1+dfsg1-3ubuntu4.13+esm12 released
xenial	Fixed 2.9.3+dfsg1-1ubuntu0.7+esm13 released

Red Hat Enterprise Linux Releases

Red Hat Product

Release

libxml2

RHEL 8	0:2.9.7-21.el8_10.9 fixed
RHEL 9	0:2.9.13-14.el9_8.5 fixed

libxml2-devel

RHEL 8	0:2.9.7-21.el8_10.9 fixed
RHEL 9	0:2.9.13-14.el9_8.5 fixed

python3-libxml2

RHEL 8	0:2.9.7-21.el8_10.9 fixed
RHEL 9	0:2.9.13-14.el9_8.5 fixed

Amazon Linux Releases

Amazon Package

Release

libxml2

Amazon Linux 2	0:2.9.1-6.amzn2.5.27 fixed
Amazon Linux 2023	0:2.10.4-1.amzn2023.0.21 fixed

libxml2-debuginfo

Amazon Linux 2	0:2.9.1-6.amzn2.5.27 fixed
Amazon Linux 2023	0:2.10.4-1.amzn2023.0.21 fixed

libxml2-debugsource

Amazon Linux 2023

0:2.10.4-1.amzn2023.0.21

fixed

libxml2-devel

Amazon Linux 2	0:2.9.1-6.amzn2.5.27 fixed
Amazon Linux 2023	0:2.10.4-1.amzn2023.0.21 fixed

libxml2-python

Amazon Linux 2

0:2.9.1-6.amzn2.5.27

fixed

libxml2-static

Amazon Linux 2	0:2.9.1-6.amzn2.5.27 fixed
Amazon Linux 2023	0:2.10.4-1.amzn2023.0.21 fixed

python3-libxml2

Amazon Linux 2023

0:2.10.4-1.amzn2023.0.21

fixed

python3-libxml2-debuginfo

Amazon Linux 2023

0:2.10.4-1.amzn2023.0.21

fixed

Azure Linux Releases

Azure Package

Release

libxml2

Azure Linux 3.0

0:2.11.5-11.azl3

fixed

Common Weakness Enumeration

CWE-121 - Stack-based Buffer Overflow
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

References

https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340

https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4