CVE-2026-86143
Quick assessment
Affected
xmlsoft libxml2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Xmlsoft libxml2是Xmlsoft公司开源的一款支持XML文档解析与处理的软件库。 Xmlsoft libxml2 2.15.4之前版本存在数字错误漏洞，该漏洞源于xmlOutputWriteCallback与xmlBufUse之间不一致，导致负长度到达写入回调且调用writecallback前缺少整数溢出检查，可能对回调内长度值的多种使用方式产生安全影响。
Possible ATT&CK Techniques 1 AI
T1061
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86143
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
整数强制转换错误
Source: CVE Program / CVE List V5
Vulnerability Title
Xmlsoft libxml2 数字错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Xmlsoft libxml2是Xmlsoft公司开源的一款支持XML文档解析与处理的软件库。 Xmlsoft libxml2 2.15.4之前版本存在数字错误漏洞，该漏洞源于xmlOutputWriteCallback与xmlBufUse之间不一致，导致负长度到达写入回调且调用writecallback前缺少整数溢出检查，可能对回调内长度值的多种使用方式产生安全影响。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-86143
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86143
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-86143 (2)
Other References for CVE-2026-86143 (1)
Same Patch Batch · xmlsoft · 2026-09-05 · 8 CVEs total
| CVE-2026-86140 | 8.0 HIGH | Xmlsoft libxml2 缓冲区错误漏洞 |
| CVE-2026-86139 | 6.9 MEDIUM | Xmlsoft libxml2 数字错误漏洞 |
| CVE-2026-86138 | 6.9 MEDIUM | Xmlsoft libxml2 数字错误漏洞 |
| CVE-2026-86142 | 6.9 MEDIUM | Xmlsoft libxml2 缓冲区错误漏洞 |
| CVE-2026-86144 | 5.6 MEDIUM | Xmlsoft libxml2 权限许可和访问控制问题漏洞 |
| CVE-2026-86141 | 2.9 LOW | Xmlsoft libxml2 异常处理不当漏洞 |
| CVE-2026-86137 | 2.9 LOW | Xmlsoft libxml2 缓冲区错误漏洞 |