Executive brief
libxml2 is a widely used library for parsing XML documents. A security flaw was identified in its xmlcatalog utility when used in interactive shell mode, where providing excessively long commands can cause the application to crash. While the project maintainers consider this a minor bug rather than a high-risk security threat, it could theoretically be used to disrupt operations or execute unauthorized commands if a user is tricked into entering malicious input.
Technical details
A stack-based buffer overflow (CWE-121) exists in the xmlcatalog utility of libxml2. The vulnerability is located in the usershell() function, which utilizes fixed-size stack buffers to process user input without performing adequate bounds checking. By supplying an input line that exceeds these buffer sizes, an attacker can overflow the 'command', 'arg', and 'argv' buffers. This requires local access and user interaction (running xmlcatalog in --shell mode). While the maintainers dispute the security impact, the flaw can result in memory corruption within the stack frame, potentially leading to arbitrary code execution or a denial of service (crash). The issue is addressed in commit c2e233fc.
Affected products
- xmlsoft libxml2 All versions through 2.15.3
Timeline
- 2026-06-29: disclosed
- 2026-06-29: advisory