Executive brief
libxml2 is a widely-used XML parsing library embedded in thousands of applications and operating systems. A flaw in the output handling code allows negative length values to be passed to callback functions due to an unchecked integer overflow, which can lead to memory corruption or information disclosure depending on how each application implements its write callbacks.
Technical details
The vulnerability is an integer overflow flaw in the xmlIO module of libxml2, specifically in the xmlOutputWriteCallback and xmlBufUse functions. The code fails to validate that a calculated length value has not overflowed to negative before passing it to registered write callbacks, allowing negative lengths to reach callback handlers. This occurs in xmlOutputBufferWrite when buffer length calculations overflow. An attacker who can control XML input processed by a vulnerable application may trigger the overflow and potentially cause memory corruption or leakage through the misuse of negative lengths in callback functions. The fix was introduced in libxml2 version 2.15.4 by adding integer overflow checks before the write callback is invoked.
Affected products
- GNOME libxml2 before 2.15.4
Timeline
- 2026-09-05: disclosed
- 2026-09-05: patched: Fix available in libxml2 2.15.4