CVE-2026-86138
Description
A flaw was found in libxml2, a software library for parsing XML documents. An integer overflow within the xmlDictAddQString function can lead to a heap-based buffer overflow. This vulnerability could allow a local attacker to execute arbitrary code on the system, potentially compromising its integrity and confidentiality.
Statement
This Moderate severity heap-based buffer overflow in libxml2, specifically within the xmlDictAddQString function, could enable arbitrary code execution. While no user interaction or privileges are required, the high attack complexity and local attack vector reduce the overall risk in Red Hat environments.
Mitigation
Bound XML document and QName (prefix + local name) size before intern. Cap process and cgroup memory so a ~4 GiB dictionary pool cannot be built. Keep FORTIFY_SOURCE and heap hardening on Red Hat binaries.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.9 | 7.8 | 6.9 |
| Attack Vector | Local | Local | Local |
| Attack Complexity | High | Low | High |
| Privileges Required | None | Low | None |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | High | High | High |
| Integrity Impact | High | High | High |
| Availability Impact | Low | High | Low |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
