CVE-2026-86139

A flaw was found in libxml2. An integer overflow vulnerability exists in the xmlURIEscapeStr function within uri.c. This flaw could potentially lead to memory corruption, allowing an attacker to achieve information disclosure or arbitrary code execution.

An issue within the libxml2 xmlURIEscapeStr function could lead to arbitrary code execution. Despite the severe potential impact, the overall vulnerability is rated Moderate due to its high attack complexity and the strict prerequisite of local system access, which collectively constrain its exploitability in standard Red Hat environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this developers must strictly cap URI and path lengths before passing data to libxml2 helpers to ensure multi-gigabyte strings cannot reach the vulnerable function. Furthermore, administrators should enforce strict process or cgroup memory limits to structurally prevent applications from allocating the excessively large buffers required to exceed maximum integer boundaries during string processing.