# CVE-2026-86141: libxml2 NULL pointer dereference in xmlRegNewParserCtxt

Source: https://junglewise.ai/threats/cve-2026-86141-libxml2-null-pointer-dereference-in-xmlregnewparserctxt  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-05. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86141 · Severity: low · CVSS 2.9 · Published 2026-09-05

libxml2 is an XML parsing library used by many applications to process XML documents. A flaw in the regular expression parser can cause the library to crash if memory allocation fails, potentially disrupting any service that relies on it for XML processing.

Technologies: [Xmlsoft Libxml2](https://junglewise.ai/threats/technologies/libxml2). Vendors: [Xmlsoft](https://junglewise.ai/threats/vendors/xmlsoft).

## Quick answers

**Is CVE-2026-86141 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86141 being exploited in the wild.

**How severe is CVE-2026-86141?** Low severity, with a CVSS score of 2.9, published 5 September 2026.

**Which products and versions are affected?** GNOME libxml2 before 2.15.4.

**Is there a fix for CVE-2026-86141?** A patch was published on 2.15.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86141 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-86141?** Check whether you run Xmlsoft Libxml2. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a NULL pointer dereference in the xmlRegNewParserCtxt() function in xmlregexp.c. The root cause is an unsafe code path where strlen() is called on a pointer returned by xmlStrdup() before checking whether the allocation succeeded. If xmlStrdup() returns NULL due to memory allocation failure, the subsequent strlen() call dereferences the NULL pointer, causing a crash. The attack vector requires the ability to trigger XML regular expression parsing with a crafted input that causes memory allocation to fail. The fix, applied in version 2.15.4, reorders the code to perform the NULL check before attempting to calculate string length.

## Affected products

- GNOME libxml2 before 2.15.4

## Timeline

- 2026-09-05: disclosed
- 2.15.4: patched

## References

- [https://github.com/GNOME/libxml2/commit/e89a8aae4c9b40cdafcf66b3f9e57c62db37bb55](https://github.com/GNOME/libxml2/commit/e89a8aae4c9b40cdafcf66b3f9e57c62db37bb55)
- [https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4](https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4)

## Related threats

- [libxml2 xinclude parseFlags not propagated](https://junglewise.ai/threats/cve-2026-86144-libxml2-xinclude-parseflags-not-propagated)
- [libxml2 integer overflow in xmlOutputWriteCallback](https://junglewise.ai/threats/cve-2026-86143-libxml2-integer-overflow-in-xmloutputwritecallback)
- [libxml2 heap buffer overflow in xmlXPtrEvalXPtrPart](https://junglewise.ai/threats/cve-2026-86142-libxml2-heap-buffer-overflow-in-xmlxptrevalxptrpart)
- [libxml2 stack-based buffer overflow in xmlSnprintfElements](https://junglewise.ai/threats/cve-2026-86140-libxml2-stack-based-buffer-overflow-in-xmlsnprintfelements)
- [libxml2 integer overflow in xmlURIEscapeStr](https://junglewise.ai/threats/cve-2026-86139-libxml2-integer-overflow-in-xmluriescapestr)