Multiple vulnerabilities found in libxml2 affecting Ubuntu 26.04 LTS
Key Takeaway
Six vulnerabilities in libxml2, including heap-based buffer overflows and XXE risks, have been addressed in Ubuntu security updates.
Summary
Ubuntu has released security updates to address several vulnerabilities in the libxml2 library. These flaws could allow attackers to cause denial of service (DoS) through crashes or excessive resource consumption, and in some cases, execute arbitrary code or perform XML external entity (XXE) injection. One specific URI escaping issue is limited to Ubuntu 26.04 LTS.
Technical breakdown of libxml2 vulnerabilities
- CVE-2026-76781: Incorrect handling of XML catalogs can lead to denial of service.
- CVE-2026-86138: Large qualified names cause a heap-based buffer overflow, potentially allowing arbitrary code execution.
- CVE-2026-86139: Improper escaping of large URI strings leads to resource exhaustion (affects Ubuntu 26.04 LTS only).
- CVE-2026-86142: Large XPointer expressions cause a heap-based buffer overflow, potentially allowing arbitrary code execution.
- CVE-2026-86143: Missing integer overflow checks before passing output lengths to write callbacks can cause application crashes.
- CVE-2026-86144: Failure to apply parser options (like disabling network access) during XInclude processing allows XXE or SSRF attacks.
Why it matters
As libxml2 is a fundamental library for XML parsing used by many applications and system services, these vulnerabilities pose a significant risk to system stability and security.
Original reference: ubuntu.com →