Executive brief
libxml2 is a widely-used library for parsing and manipulating XML documents, embedded in countless applications and services. A flaw in the dictionary string handling code can cause integer overflow, leading to a heap buffer overflow when the library processes certain XML input. An attacker could exploit this to crash applications, corrupt data, or potentially execute arbitrary code depending on how the vulnerable library is used.
Technical details
The vulnerability is an integer overflow in the xmlDictAddQString function (dict.c) that processes prefixed XML names. When calculating memory pool size, the addition of namelen + plen + 1 can overflow an unsigned int. The overflowed result is then multiplied by 4 for exponential pool growth, yielding a small allocation. Subsequent memcpy operations writing the prefix and name then overflow the undersized heap buffer. The function lacks the overflow guards present in its sibling xmlDictAddString. Exploitation requires processing specially crafted XML input with long namespace prefixes or local names. A patch adding SIZE_MAX-based overflow checks and safe size_t casting was applied in version 2.15.4.
Affected products
- GNOME libxml2 before 2.15.4
Timeline
- 2026-09-05: disclosed
- 2026: patched: Fix committed in libxml2 v2.15.4