[NEU] [mittel] libxml2: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in libxml2 ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Daten zu manipulieren oder offenzulegen und um einen Denial of Service herbeizuführen.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3195
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-861370.12% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 2% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-861380.12% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 2% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-861390.11% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 1% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-861400.14% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-861410.12% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 2% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-861420.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-861430.12% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 2% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-861440.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-86137 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-86138 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-86139 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-86140 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-86141 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-86142 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-86143 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-86144 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- lowCVE-2026-86141: xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after…msrc
- lowCVE-2026-86137: In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-boun…msrc
- highCVE-2026-86140: In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overf…msrc
- mediumCVE-2026-86139: In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.msrc
- mediumCVE-2026-86144: In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not pro…msrc
- mediumCVE-2026-86142: In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because…msrc
- mediumCVE-2026-86138: In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant he…msrc
- mediumCVE-2026-86143: In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse ca…msrc
- mediumCVE-2026-86144: In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not pro…nvd
- mediumCVE-2026-86143: In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse ca…nvd
- mediumCVE-2026-86142: In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because…nvd
- lowCVE-2026-86141: xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after…nvd
Recent advisories for libxml2
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- high[UPDATE] [hoch] libxml2: Mehrere Schwachstellen ermöglichen Denial of Servicecert-bund · 2026-09-10
- high[NEU] [hoch] libxml2: Schwachstelle ermöglicht Denial of Servicecert-bund · 2026-09-09
- highCVE-2026-74860: A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this…nvd · 2026-09-08
- lowCVE-2026-86137: In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-boun…msrc · 2026-09-08
- mediumCVE-2026-86144: In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not pro…msrc · 2026-09-08
- lowCVE-2026-86141: xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after…msrc · 2026-09-08
More from CERT-Bund (BSI) Security Advisories
- medium[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service2026-09-15
- high[UPDATE] [hoch] Linux Kernel: Mehrere Schwachstellen2026-09-15
- high[NEU] [hoch] MISP: Mehrere Schwachstellen2026-09-15
- medium[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service oder unspezifischer Angri…2026-09-15
- high[UPDATE] [hoch] Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff2026-09-15