VDB
CVE-2026-86138
CVE-2026-86138
PUBLISHED
CVSS 6.9 MEDIUM
Reported by mitre · Published September 5, 2026
In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.
Risk Scores
CVSS 3.1
6.9
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| xmlsoft | libxml2 | 0 |
| xmlsoft | libxml2 | 0, 0, 0 |
Timeline
- Sep 5, 2026 EPSS Score
- Sep 5, 2026 Coalition ESS Score
- Sep 5, 2026 CVE Published
- Sep 8, 2026 CVE Updated
- Sep 16, 2026 EPSS Score