Xmlsoft libxml2 up to 2.15.3 Xmlcatalog Utility usershell stack-based overflow ⚔ [Disputed]

Summaryinfo

A vulnerability marked as critical has been reported in Xmlsoft libxml2 up to 2.15.3. The impacted element is the function usershell of the component Xmlcatalog Utility. This manipulation causes stack-based overflow. This vulnerability appears as CVE-2026-11979. The attack may be initiated remotely. There is no available exploit. There are still doubts about whether this vulnerability truly exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Xmlsoft libxml2 up to 2.15.3. It has been declared as critical. Affected by this vulnerability is the function usershell of the component Xmlcatalog Utility. The manipulation with an unknown input leads to a stack-based overflow vulnerability. The CWE definition for the vulnerability is CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow internal buffers (command, arg, and argv) during input parsing. This results in memory corruption within the stack frame. Successful exploitation may cause a crash or potentially allow arbitrary code execution in the context of the xmlcatalog process. This issue has been fixed in the commit c2e233fc. NOTE: The maintainers of this project did not agree that this issue is a vulnerability and considered it a bug.

It is possible to read the advisory at cert.pl. This vulnerability is known as CVE-2026-11979 since 06/11/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

The real existence of this vulnerability is still doubted at the moment.

Upgrading eliminates this vulnerability. Applying the patch c2e233fc1b341685fc99621b2768b503f777a72e is able to eliminate this problem. The bugfix is ready for download at gitlab.gnome.org. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Document Processing Software

Vendor

• Xmlsoft

Name

• libxml2

Version

• 2.15.0
• 2.15.1
• 2.15.2
• 2.15.3

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion