CVE-2026-86141 | Vulnetix

CVE-2026-86141 PUBLISHED CVSS 2.9 LOW

Reported by mitre · Published September 5, 2026

xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.

Risk Scores

CVSS 3.1

2.9

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected Products

Vendor	Product	Versions
xmlsoft	libxml2	0
xmlsoft	libxml2	0, 0, 0

Timeline

Sep 5, 2026 EPSS Score
Sep 5, 2026 Coalition ESS Score
Sep 5, 2026 CVE Published
Sep 9, 2026 CVE Updated

References

Open in Interactive Console →