# CVE-2026-86138: libxml2 integer overflow and heap buffer overflow in xmlDictAddQString

Source: https://junglewise.ai/threats/cve-2026-86138-libxml2-integer-overflow-and-heap-buffer-overflow-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-05. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86138 · Severity: medium · CVSS 6.9 · Published 2026-09-05

libxml2 is a widely-used library for parsing and manipulating XML documents, embedded in countless applications and services. A flaw in the dictionary string handling code can cause integer overflow, leading to a heap buffer overflow when the library processes certain XML input. An attacker could exploit this to crash applications, corrupt data, or potentially execute arbitrary code depending on how the vulnerable library is used.

Technologies: [Xmlsoft Libxml2](https://junglewise.ai/threats/technologies/libxml2). Vendors: [Xmlsoft](https://junglewise.ai/threats/vendors/xmlsoft).

## Quick answers

**Is CVE-2026-86138 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86138 being exploited in the wild.

**How severe is CVE-2026-86138?** Medium severity, with a CVSS score of 6.9, published 5 September 2026.

**Which products and versions are affected?** GNOME libxml2 before 2.15.4.

**Is there a fix for CVE-2026-86138?** A patch was published on 2026: Fix committed in libxml2 v2.15.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86138 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-86138?** Check whether you run Xmlsoft Libxml2. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an integer overflow in the xmlDictAddQString function (dict.c) that processes prefixed XML names. When calculating memory pool size, the addition of namelen + plen + 1 can overflow an unsigned int. The overflowed result is then multiplied by 4 for exponential pool growth, yielding a small allocation. Subsequent memcpy operations writing the prefix and name then overflow the undersized heap buffer. The function lacks the overflow guards present in its sibling xmlDictAddString. Exploitation requires processing specially crafted XML input with long namespace prefixes or local names. A patch adding SIZE_MAX-based overflow checks and safe size_t casting was applied in version 2.15.4.

## Affected products

- GNOME libxml2 before 2.15.4

## Timeline

- 2026-09-05: disclosed
- 2026: patched: Fix committed in libxml2 v2.15.4

## References

- [https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4](https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4)
- [https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4](https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4)

## Related threats

- [libxml2 xinclude parseFlags not propagated](https://junglewise.ai/threats/cve-2026-86144-libxml2-xinclude-parseflags-not-propagated)
- [libxml2 integer overflow in xmlOutputWriteCallback](https://junglewise.ai/threats/cve-2026-86143-libxml2-integer-overflow-in-xmloutputwritecallback)
- [libxml2 heap buffer overflow in xmlXPtrEvalXPtrPart](https://junglewise.ai/threats/cve-2026-86142-libxml2-heap-buffer-overflow-in-xmlxptrevalxptrpart)
- [libxml2 NULL pointer dereference in xmlRegNewParserCtxt](https://junglewise.ai/threats/cve-2026-86141-libxml2-null-pointer-dereference-in-xmlregnewparserctxt)
- [libxml2 stack-based buffer overflow in xmlSnprintfElements](https://junglewise.ai/threats/cve-2026-86140-libxml2-stack-based-buffer-overflow-in-xmlsnprintfelements)