VDB
CVE-2026-86137
CVE-2026-86137
PUBLISHED
CVSS 2.9 LOW
Reported by mitre · Published September 5, 2026
In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.
Risk Scores
CVSS 3.1
2.9
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| xmlsoft | libxml2 | 0 |
| xmlsoft | libxml2 | 0, 0, 0 |
Timeline
- Sep 5, 2026 EPSS Score
- Sep 5, 2026 Coalition ESS Score
- Sep 5, 2026 CVE Published
- Sep 14, 2026 CVE Updated
- Sep 16, 2026 EPSS Score