Description

In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.9",
  "pubDate": "2026-09-05T05:17:11.490Z",
  "pubdate": "2026-09-05T05:17:11.490Z",
  "executiveSummary": "A critical out-of-bounds read vulnerability has been identified in the libxml2 library, specifically affecting versions prior to 2.15.4. The vulnerability originates within the xmlFAParsePosCharGroup function during the processing of regular expressions. This defect is triggered when the library's internal parser incorrectly handles character groups, leading to a memory access violation via the NXT macro. As an out-of-bounds read, this flaw allows an attacker to potentially access memory locations outside the intended buffers of the libxml2 library. The impact of this vulnerability includes potential information disclosure or, depending on the host application's memory layout and runtime environment, application crashes leading to a denial-of-service condition. Because libxml2 is a widely used library for XML processing in numerous systems, applications, and programming language bindings, the potential for widespread exposure is significant. Exploitation generally requires a remote or local attacker to provide a specially crafted XML input or regular expression that forces the parser into the vulnerable code path. No specific authentication is required if the target application processes untrusted user-supplied input. Security teams should prioritize patching libxml2 to version 2.15.4 or later to mitigate this risk.",
  "technicalDetails": "The vulnerability resides in the function xmlFAParsePosCharGroup within the xmlregexp.c component of libxml2. The root cause is a boundary condition error occurring during the parsing of character groups in regular expressions. Specifically, the parser fails to properly validate the input stream length or character pointer index before invoking the NXT macro. The NXT macro is designed to fetch the next character in the regular expression string; however, due to insufficient bounds checking in xmlFAParsePosCharGroup, the macro attempts to read memory beyond the allocated buffer boundaries.\nThe attack flow begins when an application utilizing a vulnerable version of libxml2 processes a maliciously crafted regular expression or XML schema containing a malformed character group sequence. When xmlFAParsePosCharGroup is invoked to parse this structure, the internal state machine advances to the point where the NXT macro is called on an exhausted or misaligned buffer. This results in a memory read operation that exceeds the allocated space for the expression input string.\nThe exploitation method relies on the attacker's ability to supply input that triggers the vulnerable logic. While the primary immediate impact is an out-of-bounds memory read, this can lead to several security outcomes. First, if the application is compiled without hardened memory protections, the read might reveal sensitive data residing in adjacent memory segments, potentially exposing cryptographic keys, session tokens, or other sensitive runtime information to the attacker. Second, the out-of-bounds read often results in a segmentation fault or an abort, which causes the library to terminate abruptly. When this occurs within a long-running service or a server process handling multiple concurrent requests, it results in a denial-of-service (DoS) condition. Because this occurs during the parsing stage, the vulnerability is reachable before full document validation, making it a high-risk vector for remote exploitation in applications that accept arbitrary XML/XPath input.\nAffected versions include all libxml2 releases prior to 2.15.4. No specific privilege elevation is necessary for exploitation, provided the attacker can influence the input passed to the libxml2 parser. The exposure is largely network-based, depending on whether the host application exposes XML parsing interfaces to external or untrusted entities. The vulnerability does not appear to be tied to authentication mechanisms, as it exists at the lower level of the library's parsing logic."
}