CVE-2026-86143: xmlsoft libxml2 Integer Coercion Error

Vulnerability summary

CVE-2026-86143 is a high (CVSS 7.3) Integer Coercion Error vulnerability in xmlsoft libxml2. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 8.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 05-09-2026
   PublishedVulnerability first disclosed.
2. 08-09-2026
   Last modifiedVulnerability information updated.

Description

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.

• CWE-192Integer Coercion ErrorInteger coercion refers to a set of flaws pertaining to the type casting, extension, or truncation of primitive data types.