Executive brief
libxml2 is a widely-used C library for parsing and processing XML documents, used by applications across operating systems and web services. A heap buffer overflow vulnerability in the XPointer parsing code could allow an attacker to trigger memory corruption and potentially execute arbitrary code when processing specially crafted XML documents with malicious XPointer expressions.
Technical details
The vulnerability is a heap-based buffer overflow in the xmlXPtrEvalXPtrPart function caused by integer overflow during xpointer length saturation. The root cause is an unchecked overflow in the xmlStrlen() call, where the result is incremented without validating that the length value has not wrapped. An attacker can craft a malicious XPointer expression in an XML document to trigger this condition; the attack requires the application to process the document and evaluate the XPointer, but no authentication or special privileges are needed. Successful exploitation allows heap memory corruption leading to potential code execution. The fix, released in version 2.15.4, adds overflow detection to check whether xmlStrlen() has overflowed before proceeding with the length increment.
Affected products
- GNOME libxml2 before 2.15.4
Timeline
- 2026-09-05: disclosed
- 2026-09-05: patched: Fix released in version 2.15.4