Description

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.9",
  "pubDate": "2026-09-05T05:17:13.270Z",
  "pubdate": "2026-09-05T05:17:13.270Z",
  "executiveSummary": "A critical integer overflow vulnerability has been identified in the xmlIO component of libxml2, affecting versions prior to 2.15.4.\nThe flaw originates from an inconsistency between xmlOutputWriteCallback and xmlBufUse, which permits negative length values to propagate to downstream write callbacks.\nThis vulnerability is significant as it facilitates potential memory corruption or undefined behavior within applications relying on libxml2 for I/O operations.\nAn attacker capable of influencing the data processed by the affected write callbacks could potentially trigger out-of-bounds memory access or other memory safety violations.\nThe risk implication is high, as libxml2 is a foundational library used across a wide array of software products, languages, and runtime environments.\nSuccessful exploitation generally requires an attacker to provide specially crafted input that causes the underlying buffer management logic to produce an invalid, negative integer length representation, subsequently passed to the callback function without adequate validation.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper handling of buffer length calculations within the xmlIO module of libxml2. Specifically, the synchronization between xmlOutputWriteCallback and the buffer usage tracking mechanism, xmlBufUse, fails to account for potential integer overflows.\nIn scenarios where output buffering is utilized, the application logic determines the number of bytes to be written by querying the buffer size. If an overflow occurs during these calculations, the length value may transition from a large positive integer to a negative value due to signed integer representation.\nBecause the write callback infrastructure in xmlIO lacks explicit bounds checking or input validation for these length parameters, the negative value is passed directly to the registered callback functions. Many callbacks assume the length parameter provided is a valid unsigned integer representing the number of bytes available for processing.\nWhen a callback receives a negative length value, it may lead to critical memory corruption scenarios. For example, if the callback uses the provided length to perform a memory allocation (e.g., malloc), a copy operation (e.g., memcpy), or a pointer offset calculation, the interpretation of the negative integer as a large unsigned value often results in heap-based buffer overflows or invalid memory access.\nThe attack flow commences when an attacker submits malicious input (such as an oversized or malformed XML document) to an application utilizing libxml2 for parsing or serialization. The processing of this input triggers the flawed internal state in xmlBufUse. Subsequently, the IO layer invokes the registered write callback with the erroneous length parameter. If the callback does not perform its own sanitization of the length input, the malicious length is utilized in subsequent memory operations.\nAffected versions include all releases of libxml2 prior to 2.15.4. The vulnerability is triggered through programmatic I/O flows and does not inherently require authentication or high-level privileges; however, it necessitates that the attacker can provide input that is subsequently processed by the library's I/O routines. The impact of successful exploitation ranges from application crashes (Denial of Service) to arbitrary code execution, depending on the specific implementation of the write callback within the host application and the surrounding memory layout."
}