xmlsoft vulnerabilities

CVEs per yearBy the year they were published

1. 20258
2. 20269

Newest CVEs

• CVE-2026-86144

  In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example,…

  xmlsoft · libxml2

  Medium5.6
• CVE-2026-86143

  In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a…

  xmlsoft · libxml2

  Medium6.9
• CVE-2026-86142

  In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.

  xmlsoft · libxml2

  Medium6.9
• CVE-2026-86141

  xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length…

  xmlsoft · libxml2

  Low2.9
• CVE-2026-86140

  In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.

  xmlsoft · libxml2

  High8.0
• CVE-2026-86139

  In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.

  xmlsoft · libxml2

  Medium6.9
• CVE-2026-86138

  In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.

  xmlsoft · libxml2

  Medium6.9
• CVE-2026-86137

  In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.

  xmlsoft · libxml2

  Low2.9
• CVE-2026-11979

  Stack-Based Buffer Overflow in libxml2

  xmlsoft · libxml2

  Low1.8
• CVE-2025-32415

  In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted…

  xmlsoft · libxml2

  Low2.9