PatchSiren cyber security CVE debrief
CVE-2026-86139 xmlsoft CVE debrief
CVE-2026-86139 is a medium-severity vulnerability in libxml2 before 2.15.4, where xmlURIEscapeStr in uri.c has an integer overflow. The CVE record was published on 2026-09-05T05:17:12.730Z and has not been modified since then. The NVD entry is currently Analyzed. This vulnerability affects libxml2 versions before 2.15.4, and defenders should assess exposure and prioritize patching. The vulnerability could potentially lead to security issues if exploited, and defenders should verify libxml2 versions and monitor for potential exploitation attempts.
- Vendor
- xmlsoft
- Product
- libxml2
- CVSS
- MEDIUM 6.9
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-09-05
- Original CVE updated
- 2026-09-15
- Advisory published
- 2026-09-05
- Advisory updated
- 2026-09-15
Who should care
Defenders and security teams using libxml2 versions before 2.15.4 should assess exposure and prioritize patching. This includes operators of systems that use libxml2, as well as security teams responsible for vulnerability management and patching. Additionally, platform owners and administrators should review the vulnerability and take necessary actions to mitigate potential risks.
Why it matters
CVE-2026-86139 is a medium-severity vulnerability in libxml2 before 2.15.4. Defenders should verify libxml2 versions, prioritize patching, and monitor for potential exploitation attempts.
- Verification of libxml2 versions and potential exposure
- Prioritization of patching or updating libxml2 versions before 2.15.4
- Monitoring for potential exploitation attempts
Technical summary
The vulnerability is an integer overflow in xmlURIEscapeStr in uri.c of libxml2 before 2.15.4. This could potentially lead to security issues if exploited, as it may allow attackers to execute arbitrary code or cause a denial of service. Defenders should prioritize verifying and applying patches for libxml2 versions before 2.15.4. The vulnerability is described in the CVE Program record and the NVD vulnerability detail page.
Defensive priority
Defenders should prioritize verifying and applying patches for libxml2 versions before 2.15.4.
Recommended defensive actions
- Verify libxml2 versions in use and assess exposure
- Apply patches or updates to libxml2 versions before 2.15.4
- Monitor systems for potential exploitation attempts
Evidence notes
The vulnerability is described as an integer overflow in xmlURIEscapeStr in uri.c of libxml2 before 2.15.4. Official sources include a CVE Program record and an NVD vulnerability detail page.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-86139 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-86139
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-86139 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-86139
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://github.com/GNOME/libxml2/commit/8edbbdb09f24d26a2f900141fddc2b9d014f53b0
[email protected] - Patch
-
Source reference
Unverified legacy reference
URL: https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4
[email protected] - Release Notes
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.