Quick answers
- Is CVE-2026-86141 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-86141 being exploited in the wild.
- How severe is CVE-2026-86141?
- Low severity, with a CVSS score of 2.9, published 5 September 2026.
- Which products and versions are affected?
- GNOME libxml2 before 2.15.4.
- Is there a fix for CVE-2026-86141?
- A patch was published on 2.15.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-86141 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-86141?
- Check whether you run Xmlsoft Libxml2. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a NULL pointer dereference in the xmlRegNewParserCtxt() function in xmlregexp.c. The root cause is an unsafe code path where strlen() is called on a pointer returned by xmlStrdup() before checking whether the allocation succeeded. If xmlStrdup() returns NULL due to memory allocation failure, the subsequent strlen() call dereferences the NULL pointer, causing a crash. The attack vector requires the ability to trigger XML regular expression parsing with a crafted input that causes memory allocation to fail. The fix, applied in version 2.15.4, reorders the code to perform the NULL check before attempting to calculate string length.
Affected products
- GNOME libxml2 before 2.15.4
Timeline
- 2026-09-05: disclosed
- 2.15.4: patched