CVE-2026-86137

What it actually does

libxml2 versions before 2.15.4 contain an out-of-bounds read in xmlFAParsePosCharGroup (the NXT macro in the xmlregexp finite-automata parser) when compiling or matching certain regular-expression character groups. The flaw is a local, high-complexity memory-corruption defect that can abort the calling process (availability impact only; confidentiality and integrity are not indicated by the CVSS profile).

Why it matters to the business

Services and applications that parse untrusted XML, XSD, or XML Schema regular expressions via libxml2 may crash, causing localized denial of service. Impact is limited: CVSS 2.9, local attack vector, high attack complexity, and no confidentiality or integrity loss. The issue is not on CISA KEV and has no reported ransomware use. Public exploit code exists, so unpatched Red Hat libxml2-main deployments should still be upgraded, but this is not an emergency internet-facing RCE. Downstream XML stacks that bundle libxml2 inherit the crash risk until they pick up 2.15.4 or the RHSA package.

How an attack unfolds

An attacker who can already cause the target process to compile or evaluate a malicious XML regular expression (for example via a local file, a schema the application loads, or another local input path into libxml2’s regexp engine) supplies a character-group pattern that drives xmlFAParsePosCharGroup past a buffer bound. The NXT macro then reads out of bounds, typically crashing the process. Exploitation requires local reachability to the parser and high-complexity input, matching AV:L/AC:H. Public exploit material is available, but there are no named APT campaigns or KEV listings associated with this CVE.

How to fix it

Upgrade libxml2 to 2.15.4 or later. On Red Hat libxml2-main, apply RHSA-2026:64463 and install libxml2-main 2.15.4-0.1.hum1 (or a later build that contains the same fix). Rebuild or redeploy any statically linked or vendored copies of libxml2 so they pick up 2.15.4+. There is no complete configuration workaround; reducing exposure to untrusted XML/regexp input is only a temporary mitigation until the library is patched.

How to confirm the fix worked

Confirm the installed libxml2 is 2.15.4 or newer (on Red Hat, package 2.15.4-0.1.hum1 or later from RHSA-2026:64463). Inventory processes dynamically linked to libxml2 and any statically vendored copies. After upgrade, restart dependent services and verify they load the patched library (e.g., package manager query, ldd/rpm/dpkg equivalent, or vendor SBOM). Regression-test XML Schema and regexp-heavy parsing paths to ensure they no longer crash on previously triggering inputs.

Typical attack path

1. Gain local ability to submit XML, XSD, or regexp input that libxml2 will compile or match
2. Craft a character-group pattern that triggers the out-of-bounds read in xmlFAParsePosCharGroup / NXT
3. Cause the application or service to parse that input through vulnerable libxml2 (< 2.15.4)
4. Induce a process crash (DoS); no privilege escalation or data integrity impact is indicated

How to detect it

This is an out-of-bounds read that typically presents as a crash, not as a distinct network payload. Hunt historical process crashes, coredumps, and abort logs in applications linked to libxml2, especially those that parse XML Schema or regular expressions. Look for fatal signals (SIGSEGV/SIGABRT) with stack frames in xmlFAParsePosCharGroup, xmlregexp, or libxml2 around XML regexp compilation. There are no known campaign-specific network signatures or ransomware artifacts. Correlate crashes with local XML/XSD ingest around 2026-09-05 onward if investigating possible prior abuse of public exploit code.

• xmlFAParsePosCharGroup
• libxml2
• xmlregexp
• SIGSEGV
• NXT

What your security team should do

• Patch Red Hat libxml2-main to 2.15.4-0.1.hum1 (RHSA-2026:64463) or libxml2 2.15.4+ on all other platforms
• Inventory runtime and vendored libxml2 usage, including language bindings and XML-heavy products
• Prioritize hosts that compile or match untrusted XML Schema regular expressions, then remaining libxml2 consumers
• Treat as a standard patch cycle item (low CVSS, not KEV) but do not defer indefinitely because exploit code is public
• After patching, restart services and confirm no remaining < 2.15.4 libxml2 mappings