CVE-2026-86140

A flaw was found in libxml2. A local attacker could exploit a stack-based buffer overflow in the xmlSnprintfElements function to achieve arbitrary code execution. This vulnerability in a fundamental system library could lead to significant system compromise if successfully exploited.

This Important flaw in libxml2 allows a local attacker to achieve arbitrary code execution due to a stack-based buffer overflow. While requiring local access, the vulnerability's presence in a fundamental system library could lead to significant system compromise if exploited.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this, administrators should disable DTD processing and validation for untrusted documents within libxml2 parsers and restrict network access so only authorized users can submit XML data to the application. For robust defense-in-depth against buffer overflow exploitation, ensure the library and dependent applications are compiled with memory safety flags like stack canaries (-fstack-protector-strong) and bounds checking (_FORTIFY_SOURCE=2), while verifying that standard OS-level protections such as ASLR and Data Execution Prevention (NX/XD Bit) are active on the host system.