Executive brief
libxml2 is a widely-used XML parsing library integrated into countless applications and operating systems. A stack-based buffer overflow in the xmlSnprintfElements function could allow an attacker to crash applications or execute arbitrary code by providing specially crafted XML input. This vulnerability affects systems that process untrusted XML documents.
Technical details
The vulnerability is a stack-based buffer overflow in the xmlSnprintfElements function in valid.c, caused by unchecked strcat() calls that write to a fixed-size buffer without bounds checking. The vulnerable code calls strcat(buf, "(") and strcat(buf, ")") without verifying that sufficient space remains in the buffer. An attacker can trigger this by providing malformed XML with deeply nested or specially constructed element definitions that cause the buffer to overflow. The vulnerability was patched in version 2.15.4 by adding remaining-space checks before both strcat calls, returning early with ellipsis notation when buffer space is insufficient. No active exploitation in the wild has been reported.
Affected products
- GNOME libxml2 before 2.15.4
Timeline
- 2026-09-05: disclosed
- 2026-09-05: patched: fixed in version 2.15.4