Description

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.9",
  "pubDate": "2026-09-05T05:17:12.600Z",
  "pubdate": "2026-09-05T05:17:12.600Z",
  "executiveSummary": "A critical vulnerability identified in libxml2 versions prior to 2.15.4 involves an integer overflow within the xmlDictAddQString function located in dict.c.\nThis vulnerability leads to a heap-based buffer overflow, which may allow an unauthenticated remote attacker to execute arbitrary code or cause a denial-of-service condition.\nThe flaw stems from improper arithmetic validation during the dictionary string addition process, resulting in insufficient memory allocation.\nSuccessful exploitation requires the processing of a maliciously crafted input, such as an XML document, by the affected libxml2 library.\nThe risk implication is high, as libxml2 is a foundational component used in a wide array of applications and operating systems, potentially exposing numerous systems to memory corruption attacks.\nThe impact depends on the specific host application, but generally includes application crashes or potential remote code execution via controlled heap memory corruption.",
  "technicalDetails": "The vulnerability resides in the xmlDictAddQString function within dict.c of the libxml2 library. The root cause is an integer overflow that occurs during the calculation of the memory required to store a new dictionary entry.\nIn the affected versions (prior to 2.15.4), the function fails to adequately validate the length of the input string against the constraints of the underlying data structures. When an excessively long string is processed, the arithmetic operation used to determine the buffer size wraps around due to integer overflow.\nThis incorrect calculation leads to a heap-based buffer overflow, as the library allocates significantly less memory than is required to hold the string. Subsequent operations then write data beyond the bounds of the allocated buffer on the heap.\nThe exploitation flow begins when an attacker provides a crafted XML file containing a specially formed input string that triggers the flawed arithmetic in xmlDictAddQString. As the XML parser processes the input, the library attempts to intern the string into its global or document-specific dictionary.\nBecause the allocation size is incorrectly calculated, the overflow occurs during the memory copy phase. This allows an attacker to overwrite adjacent heap metadata or other application data structures. By carefully controlling the heap layout, an attacker may be able to redirect execution flow or corrupt sensitive object pointers, leading to arbitrary code execution within the context of the application using libxml2.\nThis vulnerability does not require prior authentication, as it is triggered through the standard parsing process of an external, potentially untrusted, XML document. The memory corruption is limited to the heap, but given the ubiquitous nature of the libxml2 library, the impact on the security posture of the host system is significant. Post-exploitation, an attacker could maintain persistent control, elevate privileges, or exfiltrate sensitive data depending on the permissions and functionality of the parent process."
}