Executive brief
libxml2 is an XML parsing library used by many applications to process XML documents. A flaw in the regular expression parser can cause the library to crash if memory allocation fails, potentially disrupting any service that relies on it for XML processing.
Technical details
The vulnerability is a NULL pointer dereference in the xmlRegNewParserCtxt() function in xmlregexp.c. The root cause is an unsafe code path where strlen() is called on a pointer returned by xmlStrdup() before checking whether the allocation succeeded. If xmlStrdup() returns NULL due to memory allocation failure, the subsequent strlen() call dereferences the NULL pointer, causing a crash. The attack vector requires the ability to trigger XML regular expression parsing with a crafted input that causes memory allocation to fail. The fix, applied in version 2.15.4, reorders the code to perform the NULL check before attempting to calculate string length.
Affected products
- GNOME libxml2 before 2.15.4
Timeline
- 2026-09-05: disclosed
- 2.15.4: patched