Description

xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.9",
  "pubDate": "2026-09-05T05:17:13.007Z",
  "pubdate": "2026-09-05T05:17:13.007Z",
  "executiveSummary": "This vulnerability involves a NULL pointer dereference within the xmlRegNewParserCtxt function of libxml2, specifically affecting versions prior to 2.15.4.\nThe issue arises due to insufficient error handling following a failed memory allocation request via strdup. When the allocation fails, the subsequent code attempts to perform a string length calculation on the resulting NULL pointer, triggering an immediate process crash.\nThe vulnerability is categorized as a NULL pointer dereference, a common memory safety flaw that can lead to Denial of Service (DoS) conditions.\nThe impact is primarily focused on service availability; an attacker providing crafted input that forces a heap allocation failure can cause the application using libxml2 to terminate unexpectedly.\nNo authentication or elevated privileges are required to trigger this condition if the input is processed by an exposed interface, such as a web service or API endpoint that parses XML or regex patterns.\nOrganizations utilizing libxml2 should prioritize updating to version 2.15.4 or later to ensure the necessary NULL pointer checks are implemented.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper management of memory allocation return values within the xmlRegNewParserCtxt function. In C, the strdup function dynamically allocates memory for a string duplicate. Under memory-constrained conditions or resource exhaustion, strdup may return a NULL pointer indicating an allocation failure.\nThe affected implementation in libxml2 fails to validate the return value of this specific strdup operation before proceeding. The logic path continues execution, attempting to calculate the length of the string using a function like strlen or an equivalent internal routine. When this function is invoked with the NULL pointer generated by the previous failure, the CPU attempts to access address 0x0, resulting in a segmentation fault and an immediate crash of the calling process.\nThe attack flow follows a predictable pattern: 1) An attacker identifies an input vector that triggers the xmlRegNewParserCtxt routine within libxml2. 2) The attacker attempts to manipulate the environment or provide sufficiently large/complex inputs to induce a heap allocation failure during the strdup operation. 3) The function proceeds to perform pointer arithmetic or dereferencing on the NULL pointer returned by the failed allocation. 4) The process experiences a fatal signal (SIGSEGV) and terminates, effectively creating a Denial of Service scenario.\nThis vulnerability affects the libxml2 library, specifically the xmlregexp component. It is present in all versions prior to 2.15.4. Exploitation does not require prior authentication or elevated privileges, making it a viable target for remote attackers capable of interacting with applications that parse untrusted XML data or regular expressions using the affected library versions.\nThe impact of this vulnerability is strictly limited to application availability. Since the crash occurs during the parsing phase, it does not typically lead to arbitrary code execution; however, the impact is significant for high-availability systems where the crash of an XML parser thread or process could lead to cascading failures or prolonged service outages. The absence of proper NULL checking transforms a recoverable resource failure into a critical system fault."
}