Description

libnxml before 0.18.6 contains a stack-based buffer overflow vulnerability in src/nxml_parser.c that allows remote attackers to write past a 1024-byte stack buffer via long XML names. Attackers can supply XML or RSS feeds with a 1022-character element, attribute, DOCTYPE or entity name ending in a multi-byte UTF-8 character to crash parsing applications.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-05T19:17:19.337Z",
  "pubdate": "2026-11-05T19:17:19.337Z",
  "executiveSummary": "The libnxml library, specifically in versions prior to 0.18.6, is susceptible to a stack-based buffer overflow vulnerability residing within the nxml_parser.c file.\nThis vulnerability is classified as a memory corruption flaw, which occurs when the parser fails to properly bound-check input length before copying it into a fixed-size stack buffer.\nAn attacker can exploit this by supplying a crafted XML or RSS feed containing maliciously long entity, attribute, element, or DOCTYPE names.\nThe successful exploitation of this flaw can result in application crashes, leading to a Denial of Service (DoS) state. Furthermore, depending on the memory layout and attacker control over the overflow data, there is potential for arbitrary code execution within the context of the affected process.\nThe vulnerability is remotely exploitable and does not require prior authentication, making it a significant risk for any application utilizing libnxml to process untrusted XML data streams.\nSystem administrators and developers are advised to upgrade to version 0.18.6 or higher immediately to remediate the underlying logic error.",
  "technicalDetails": "The vulnerability is rooted in a stack-based buffer overflow within the src/nxml_parser.c file of the libnxml library. The parser utilizes a static 1024-byte buffer on the stack to store processed tokens, such as XML element names, attribute names, DOCTYPE declarations, or entity names. The flaw arises from an inadequate implementation of boundary validation logic when handling input of excessive length.\nExploitation is achieved by providing an XML or RSS feed that contains a name field precisely 1022 characters in length, supplemented by a multi-byte UTF-8 character at the end. When the parser processes this input, the combination of the long string and the subsequent multi-byte sequence results in an out-of-bounds write operation. Because the buffer is stack-allocated, this write operation enables an attacker to overwrite adjacent memory addresses on the stack, including saved return addresses, function pointers, or local variables.\nThe attack flow follows a specific sequence: First, the attacker identifies an application that consumes XML-based feeds via the vulnerable libnxml library. Second, the attacker crafts a malicious XML payload with an element or attribute name that exceeds the intended capacity of the 1024-byte buffer. Third, the payload is delivered to the target application. Fourth, as the parser iterates through the input stream, it copies the oversized data into the stack buffer without performing a bounds check. The final multi-byte character sequence often bypasses simplified length checks or triggers an incorrect calculation of the remaining buffer space, ultimately facilitating the overflow.\nThe impact of this vulnerability is severe. At a minimum, the corruption of stack frames leads to an immediate crash of the parsing application, effectively causing a Denial of Service. In more sophisticated scenarios, if the attacker can control the data written past the boundary, they may be able to redirect execution flow to attacker-supplied shellcode or leverage Return-Oriented Programming (ROP) techniques to bypass security controls like Data Execution Prevention (DEP). The vulnerability is fully remotely exploitable without authentication, as the input processing logic is exposed to incoming network data streams."
}