libxml2 2.15.4 patches eight XML parsing memory flaws

libxml2 2.15.4, dated 1 September 2026, fixes a cluster of memory-safety bugs in core XML handling. Eight CVEs cover out-of-bounds reads, integer overflows that become heap or stack buffer overflows, a NULL dereference, and unsafe lengths passed to write callbacks. The library is a foundational dependency for document parsers, browsers, package tools, and countless applications that ingest untrusted XML, so the flaws matter well beyond the library itself.

CVE-2026-86137 is an out-of-bounds read in regular-expression character-group parsing. CVE-2026-86138 and CVE-2026-86139 are integer overflows in dictionary string insertion and URI escaping; the dictionary case can produce a heap buffer overflow. CVE-2026-86140 is a stack buffer overflow from an unchecked strcat while formatting element lists for validation. CVE-2026-86141 is a NULL pointer dereference in the regexp parser context after a failed string duplication. CVE-2026-86142 is a heap buffer overflow in XPointer evaluation caused by length saturation. CVE-2026-86143 lets negative lengths reach output write callbacks because an integer overflow was not checked first, with security impact depending on how callers use that length. CVE-2026-86144 concerns XInclude processing failing to propagate parse flags correctly.

Sam James reported the 2.15.4 security notes to oss-security; Salvatore Bonaccorso listed the assigned CVE identifiers. No further exploitation detail was published with the announcement. Operators who ship or link libxml2 should move to 2.15.4 or apply equivalent backports.