Description

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.9",
  "pubDate": "2026-09-05T05:17:12.730Z",
  "pubdate": "2026-09-05T05:17:12.730Z",
  "executiveSummary": "A critical integer overflow vulnerability exists in the xmlURIEscapeStr function within the libxml2 library, specifically affecting versions prior to 2.15.4.\nThis vulnerability is classified as an integer overflow, which occurs during the processing of URI strings when calculating memory allocation requirements.\nThe flaw potentially allows an attacker to trigger an out-of-bounds write or memory corruption by providing a specially crafted input that causes an integer calculation to wrap around.\nSuccessful exploitation could lead to arbitrary code execution, denial-of-service (application crash), or unauthorized memory access.\nThe vulnerability resides in the core URI parsing logic of libxml2, making any application that relies on this library for URI manipulation and XML processing susceptible.\nRisk is significant, as libxml2 is a widely deployed, low-level dependency in numerous software stacks, including web browsers, document processors, and language runtimes.\nNo specific authentication or specialized user privileges are required for exploitation if an application processes untrusted, attacker-controlled URI strings.",
  "technicalDetails": "The vulnerability originates in the function xmlURIEscapeStr located in uri.c within the libxml2 library. The root cause is an integer overflow that occurs during the calculation of the buffer size necessary to store an escaped URI string.\nWhen xmlURIEscapeStr is invoked to encode characters within a URI, the implementation calculates the required output buffer length. If the input string is sufficiently large or maliciously crafted, the arithmetic operations involved in determining this length can exceed the maximum value representable by the integer type used, leading to an integer wrap-around.\nThis overflow leads to the allocation of a buffer smaller than the amount of data intended to be written into it. Consequently, when the function proceeds to perform the escaping process, it executes an out-of-bounds write to memory, overwriting adjacent data on the heap.\nThe attack flow typically involves an attacker supplying an XML document or URI string that triggers the vulnerable codepath in an application utilizing libxml2. Because this function is frequently used as an internal utility for data normalization, the attack vector is often indirect, occurring through standard XML parsing or URI processing operations.\nExploitation requires the attacker to control or influence the input passed to the affected URI processing function. Once the integer overflow is triggered and the subsequent heap-based buffer overflow occurs, an attacker may achieve memory corruption. Depending on the memory layout and the specific runtime environment, this corruption can be leveraged to overwrite function pointers, return addresses, or other critical data structures, potentially leading to arbitrary code execution within the context of the application process.\nThis issue affects all versions of libxml2 prior to 2.15.4. It is notable that memory corruption vulnerabilities in such fundamental parsing libraries are inherently dangerous due to their ubiquitous nature and the difficulty of isolating them from standard application operations. The vulnerability does not require authentication, as the processing of the URI string is often a stateless operation performed early in the parsing pipeline. The impact of successful exploitation ranges from process instability and service termination—effectively a denial of service—to complete system compromise if the attacker can bypass existing memory protections like ASLR or DEP through sophisticated heap manipulation."
}