Is CVE-2026-11979 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11979 being exploited in the wild.

How severe is CVE-2026-11979?

Informational severity, with a CVSS score of 1.8, published 29 June 2026.

Which products and versions are affected?

Xmlsoft Libxml2 All versions through 2.15.3.

Is there a fix for CVE-2026-11979?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11979 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-11979?

Check whether you run Xmlsoft Libxml2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11979: xmlsoft libxml2 stack buffer overflow in xmlcatalog shell

CVE-2026-11979 · Severity: info · CVSS 1.8 · Published 2026-06-29

libxml2 is a widely used library for parsing XML documents. A security flaw was identified in its xmlcatalog utility when used in interactive shell mode, where providing excessively long commands can cause the application to crash. While the project maintainers consider this a minor bug rather than a high-risk security threat, it could theoretically be used to disrupt operations or execute unauthorized commands if a user is tricked into entering malicious input.

Technologies: Xmlsoft Libxml2. Vendors: Xmlsoft.

Quick answers

Is CVE-2026-11979 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11979 being exploited in the wild.
How severe is CVE-2026-11979?: Informational severity, with a CVSS score of 1.8, published 29 June 2026.
Which products and versions are affected?: Xmlsoft Libxml2 All versions through 2.15.3.
Is there a fix for CVE-2026-11979?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11979 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-11979?: Check whether you run Xmlsoft Libxml2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow (CWE-121) exists in the xmlcatalog utility of libxml2. The vulnerability is located in the usershell() function, which utilizes fixed-size stack buffers to process user input without performing adequate bounds checking. By supplying an input line that exceeds these buffer sizes, an attacker can overflow the 'command', 'arg', and 'argv' buffers. This requires local access and user interaction (running xmlcatalog in --shell mode). While the maintainers dispute the security impact, the flaw can result in memory corruption within the stack frame, potentially leading to arbitrary code execution or a denial of service (crash). The issue is addressed in commit c2e233fc.

Affected products

xmlsoft libxml2 All versions through 2.15.3

Timeline

2026-06-29: disclosed
2026-06-29: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.