Description

In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.9",
  "pubDate": "2026-09-05T05:17:13.133Z",
  "pubdate": "2026-09-05T05:17:13.133Z",
  "executiveSummary": "A critical heap-based buffer overflow vulnerability exists in libxml2 versions prior to 2.15.4 within the xmlXPtrEvalXPtrPart function.\nThe vulnerability is caused by improper handling of xpointer length, leading to memory corruption during evaluation processes.\nSuccessful exploitation allows an attacker to trigger an out-of-bounds write on the heap, which can lead to arbitrary code execution, system instability, or denial-of-service conditions.\nThe vulnerability affects applications utilizing the libxml2 library for processing XML documents or XPointer expressions.\nExploitation generally requires the attacker to provide a specially crafted, malicious XML or XPointer input to an application that processes untrusted data using the affected versions of libxml2.\nGiven the ubiquitous nature of libxml2, the risk profile is considered high, potentially impacting a wide range of software ecosystems and security boundaries.",
  "technicalDetails": "The root cause of this vulnerability is an integer saturation flaw during the processing of XPointer expressions within the xmlXPtrEvalXPtrPart function in libxml2.\nWhen parsing complex or malformed XPointer expressions, the library fails to correctly validate the length of the evaluated segment, leading to an arithmetic overflow or improper length calculation.\nThis calculation failure results in a heap-based buffer overflow, where data is written beyond the allocated boundaries of a heap buffer during the evaluation of the xpointer length.\nThe attack flow initiates when a malicious actor submits a crafted XML document or XPointer query to an application linked against a vulnerable version of libxml2.\nThe library's parser, specifically the XPointer evaluation engine, attempts to parse the payload, triggering the faulty length calculation logic within xmlXPtrEval.\nBecause the length check is bypassed or fails to account for the actual size of the input, the internal memory copy operations result in memory corruption within the heap segment.\nAn attacker can leverage this memory corruption to overwrite adjacent heap metadata or function pointers, potentially redirecting program execution flow to attacker-controlled memory segments.\nThis vulnerability does not strictly require pre-authentication, as the exposure exists at the input processing layer of any application that allows users to supply XML data or XPath/XPointer expressions.\nThe post-exploitation impact ranges from process crashes—resulting in a denial-of-service—to the execution of arbitrary code under the privileges of the application process.\nSince libxml2 is often integrated into web servers, database engines, and language runtimes, the potential for privilege escalation and cross-application compromise is significant.\nThe lack of robust bounds checking in the xpointer length handling logic represents a failure to implement defensive programming practices against length-based injection attacks, making the heap memory susceptible to corruption by overly large or specifically crafted pointers."
}