CVE-2026-86142 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.9 MEDIUM	LOCAL	HIGH	NONE	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Base Score

CVSS 3.x

EPSS Score

Percentile: 4.36%

Affected Products (NVD)

Vendor	Product	Version
xmlsoft	libxml2	𝑥 < 2.15.4

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

libxml2

bookworm	postponed
bookworm (security)	vulnerable
forky	2.15.4+dfsg-1 fixed
sid	2.15.4+dfsg-1 fixed
trixie	vulnerable
trixie (security)	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

libxml2

bionic	Fixed 2.9.4+dfsg1-6.1ubuntu1.9+esm9 released
focal	Fixed 2.9.10+dfsg-5ubuntu0.20.04.10+esm6 released
jammy	Fixed 2.9.13+dfsg-1ubuntu0.14 released
noble	Fixed 2.9.14+dfsg-1.3ubuntu3.10 released
resolute	Fixed 2.15.2+dfsg-0.1ubuntu0.3 released
trusty	Fixed 2.9.1+dfsg1-3ubuntu4.13+esm13 released
xenial	Fixed 2.9.3+dfsg1-1ubuntu0.7+esm14 released

Red Hat Enterprise Linux Releases

Red Hat Product

Release

libxml2

RHEL 8	0:2.9.7-21.el8_10.10 fixed
RHEL 9	0:2.9.13-14.el9_8.5 fixed

libxml2-devel

RHEL 8	0:2.9.7-21.el8_10.10 fixed
RHEL 9	0:2.9.13-14.el9_8.5 fixed

python3-libxml2

RHEL 8	0:2.9.7-21.el8_10.10 fixed
RHEL 9	0:2.9.13-14.el9_8.5 fixed

Amazon Linux Releases

Amazon Package

Release

libxml2

Amazon Linux 2	0:2.9.1-6.amzn2.5.27 fixed
Amazon Linux 2023	0:2.10.4-1.amzn2023.0.21 fixed

libxml2-debuginfo

Amazon Linux 2	0:2.9.1-6.amzn2.5.27 fixed
Amazon Linux 2023	0:2.10.4-1.amzn2023.0.21 fixed

libxml2-debugsource

Amazon Linux 2023

0:2.10.4-1.amzn2023.0.21

fixed

libxml2-devel

Amazon Linux 2	0:2.9.1-6.amzn2.5.27 fixed
Amazon Linux 2023	0:2.10.4-1.amzn2023.0.21 fixed

libxml2-python

Amazon Linux 2

0:2.9.1-6.amzn2.5.27

fixed

libxml2-static

Amazon Linux 2	0:2.9.1-6.amzn2.5.27 fixed
Amazon Linux 2023	0:2.10.4-1.amzn2023.0.21 fixed

python3-libxml2

Amazon Linux 2023

0:2.10.4-1.amzn2023.0.21

fixed

python3-libxml2-debuginfo

Amazon Linux 2023

0:2.10.4-1.amzn2023.0.21

fixed

Azure Linux Releases

Azure Package

Release

libxml2

Azure Linux 3.0

0:2.11.5-11.azl3

fixed

Common Weakness Enumeration

CWE-122 - Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

References

https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58

https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4

https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113