Executive brief
libxml2 is a widely-used XML parsing library integrated into many applications and operating systems. A flaw in the regular expression parser could allow an attacker to trigger out-of-bounds memory access by providing a specially crafted XML document, potentially causing an application crash or information disclosure.
Technical details
An out-of-bounds read vulnerability exists in the NXT macro within the xmlregexp.c file, specifically in the xmlFAParsePosCharGroup function. The vulnerability occurs due to insufficient bounds checking when accessing memory via the macro, allowing an attacker to read beyond the allocated string buffer. The attack requires parsing a malicious XML regular expression pattern; no authentication is required. The flaw can result in denial of service or potential information exposure. The vulnerability has been patched in libxml2 version 2.15.4 with bounds checking added to the NXT macro definition.
Affected products
- GNOME libxml2 before 2.15.4
Timeline
- 2026-09-05: disclosed
- 2026: patched: Fixed in libxml2 2.15.4