CVE-2026-86138

A flaw was found in libxml2, a software library for parsing XML documents. An integer overflow within the xmlDictAddQString function can lead to a heap-based buffer overflow. This vulnerability could allow a local attacker to execute arbitrary code on the system, potentially compromising its integrity and confidentiality.

This Moderate severity heap-based buffer overflow in libxml2, specifically within the xmlDictAddQString function, could enable arbitrary code execution. While no user interaction or privileges are required, the high attack complexity and local attack vector reduce the overall risk in Red Hat environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Bound XML document and QName (prefix + local name) size before intern. Cap process and cgroup memory so a ~4 GiB dictionary pool cannot be built. Keep FORTIFY_SOURCE and heap hardening on Red Hat binaries.