CVE-2026-123202 in libnxml
Summary
by MITRE • 11/05/2026
libnxml before 0.18.6 contains a stack-based buffer overflow vulnerability in src/nxml_parser.c that allows remote attackers to write past a 1024-byte stack buffer via long XML names. Attackers can supply XML or RSS feeds with a 1022-character element, attribute, DOCTYPE or entity name ending in a multi-byte UTF-8 character to crash parsing applications.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in libnxml prior to version 0.18.6 represents a critical stack-based buffer overflow located within the source file nxml_parser.c. This flaw arises from an insufficient boundary check when processing XML or RSS feeds that contain element, attribute, DOCTYPE, or entity names exceeding specific length thresholds while utilizing multi-byte UTF-8 characters. Specifically, attackers can craft malicious input with a name of 1022 characters followed by a multi-byte UTF-8 character sequence to trigger the overflow against a fixed-size stack buffer of 1024 bytes. The root cause lies in the parser's failure to correctly account for byte length versus character count when validating input sizes, leading to memory corruption as data is written beyond the allocated stack space without proper bounds checking mechanisms in place.
From an operational perspective, this vulnerability allows remote attackers to crash applications that rely on libnxml for parsing XML or RSS content. While immediate exploitation may result primarily in denial of service conditions through application crashes, buffer overflows inherently carry significant risk for arbitrary code execution if the attacker can precisely control the overflowed data and manipulate return addresses or function pointers stored on the stack. The use of multi-byte UTF-8 characters complicates detection by standard length validation routines that might only count character units rather than actual byte sizes consumed in memory, thereby bypassing naive security checks designed to prevent such overflows.
This issue aligns with Common Weakness Enumeration CWE-121, which describes stack-based buffer overflow vulnerabilities where a program writes data past the end of a stack-allocated buffer. Additionally, it relates to CWE-20 regarding improper input validation, as the parser fails to adequately sanitize or validate the length and encoding of incoming XML identifiers before processing them into fixed-size buffers. In terms of attack vectors, this vulnerability supports techniques associated with MITRE ATT&CK T1190, which covers Exploit Public-Facing Applications, particularly when libnxml is integrated into web services or APIs that accept user-supplied XML data from external sources without sufficient validation layers.
To mitigate the risks posed by this vulnerability, organizations must immediately upgrade to version 0.18.6 or later of libnxml where these boundary checks have been corrected. For environments unable to update promptly, implementing input filtering at the application layer is recommended to reject XML elements, attributes, DOCTYPE declarations, and entity names that exceed safe length limits before they reach the parser. Additionally, deploying runtime protection mechanisms such as stack canaries or address space layout randomization can help detect or prevent exploitation attempts by identifying corrupted return addresses or unauthorized memory access patterns during execution.