CVE-2026-86144
Quick assessment
Affected
xmlsoft libxml2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 libxml2 2.15.4 之前的版本中，xinclude 功能中的 和 函数未能正确传递 （解析标志）。这一问题具有安全影响：例如，若未传递 标志，自定义资源加载器可能会访问互联网，从而触发 XML 外部实体注入（XXE）、服务端请求伪造（SSRF）或拒绝服务（DoS）漏洞（例如，当攻击者控制的互联网资源被故意设置得很慢时，导致服务延迟或耗尽）。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86144
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
在范围间的资源转移不正确
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-86144
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86144
请登录查看更多情报信息。
Other References for CVE-2026-86144 (2)
Same Patch Batch · xmlsoft · 2026-09-05 · 8 CVEs total
| CVE-2026-86140 | 8.0 HIGH | libxml2<2.15.4 valid.c strcat栈溢出 |
| CVE-2026-86143 | 6.9 MEDIUM | libxml2 2.15.4 前 xmlIO 整数溢出 |
| CVE-2026-86142 | 6.9 MEDIUM | libxml2 2.15.4前 xpointer堆溢出 |
| CVE-2026-86139 | 6.9 MEDIUM | libxml2 2.15.4 前 xmlURIEscapeStr 整数溢出 |
| CVE-2026-86138 | 6.9 MEDIUM | libxml2<2.15.4整数溢出致堆缓冲区溢出 |
| CVE-2026-86141 | 2.9 LOW | libxml2<2.15.4 NULL指针解引用 |
| CVE-2026-86137 | 2.9 LOW | libxml2 <2.15.4 越界读取漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-86144
No comments yet