Skip to content
Fencer Vulns
high 7.8

CVE-2026-11979 json

Stack-Based Buffer Overflow in libxml2

published 2026-06-29 4 mo ago modified 2026-10-25 14 d ago also EUVD-2026-40092

cvss
7.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 4%
public exploits
0
none known

Summary

libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow internal buffers (command, arg, and argv) during input parsing. This results in memory corruption within the stack frame. Successful exploitation may cause a crash or potentially allow arbitrary code execution in the context of the xmlcatalog process.

This issue has been fixed in the commit c2e233fc.

NOTE: The maintainers of this project did not agree that this issue is a vulnerability and considered it a bug.

Patch / fix

  • libxml2 Debian 14 2.15.4+dfsg-1

debian advisories DEBIAN-CVE-2026-11979

  • libxml2 RHEL 9 2.9.13-14.el9_8.4
  • python3-libxml2 RHEL 9 2.9.13-14.el9_8.4
  • libxml2 RHEL 8 2.9.7-21.el8_10.7
  • python3-libxml2 RHEL 8 2.9.7-21.el8_10.7
  • libxml2 RHEL 10.2 2.12.5-10.el10_2.3
  • python3-libxml2 RHEL 10.2 2.12.5-10.el10_2.3
  • libxml2 hummingbird 1 2.15.3-0.1.1.hum1
  • libxml2-16 hummingbird 1 2.15.3-0.1.1.hum1

red hat advisories RHSA-2026:61247RHSA-2026:61248RHSA-2026:60394RHSA-2026:33840

  • libxml2 Linux Micro 6.1 2.11.6-slfo.1.1_9.1
  • libxml2-python Linux Micro 6.1 2.11.6-slfo.1.1_9.1
  • libxml2 Linux Micro 6.0 2.11.6-13.1
  • libxml2-python Linux Micro 6.0 2.11.6-13.1
  • libxml2 SLE Module for Basesystem 15 SP7 2.12.10-150700.4.14.1
  • libxml2-python SLE Module for Python 3 15 SP7, SLE Module for Basesystem 15 SP7 2.12.10-150700.4.14.1
  • libxml2 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES 15 SP6-LTSS +4 more 2.10.3-150500.5.41.1
  • libxml2-python SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES 15 SP6-LTSS +4 more 2.10.3-150500.5.41.1

suse advisories SUSE-SU-2026:22894-1SUSE-SU-2026:22806-1SUSE-SU-2026:3111-1SUSE-SU-2026:3097-1SUSE-SU-2026:3096-1SUSE-SU-2026:3095-1

  • libxml2 openSUSE Leap 16.0 2.13.8-160000.5.1
  • libxml2-python openSUSE Leap 16.0 2.13.8-160000.5.1
  • libxml2 openSUSE Tumbleweed 2.15.3-2.1

opensuse advisories openSUSE-SU-2026:21317-1openSUSE-SU-2026:11258-1

  • libxml2 AlmaLinux 9 2.9.13-14.el9_8.4
  • python3-libxml2 AlmaLinux 9 2.9.13-14.el9_8.4
  • libxml2 AlmaLinux 8 2.9.7-21.el8_10.7
  • python3-libxml2 AlmaLinux 8 2.9.7-21.el8_10.7
  • libxml2 AlmaLinux 10 2.12.5-10.el10_2.3
  • python3-libxml2 AlmaLinux 10 2.12.5-10.el10_2.3

almalinux advisories ALSA-2026:61247ALSA-2026:61248ALSA-2026:60394

  • libxml2 Rocky Linux 9 2.9.13-14.el9_8.4
  • libxml2 Rocky Linux 8 2.9.7-21.el8_10.7
  • libxml2 Rocky Linux 10 2.12.5-10.el10_2.3

rocky linux advisories RLSA-2026:61247RLSA-2026:61248RLSA-2026:60394

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-11979 updated cvss 5.9

libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow

  • Red Hat Enterprise Linux 6 libxml2, libxml2-python Red Hat Enterprise Linux 7 libxml2, libxml2-python Red Hat Enterprise Linux 8 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +2 more Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.17 cert-manager/cert-manager-operator-rhel9 1791788287, cert-manager/jetstack-cert-manager-rhel9 1791371069, cert-manager/cert-manager-istio-csr-rhel9 1791378395, cert-manager/cert-manager-operator-bundle 1791970484, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791371080
    fixed: vendor fix RHSA-2026:82336
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.18 cert-manager/cert-manager-operator-rhel9 1789029076, cert-manager/jetstack-cert-manager-rhel9 1791459711, cert-manager/cert-manager-istio-csr-rhel9 1791459759, cert-manager/cert-manager-operator-bundle 1791966259, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791459707
    fixed: vendor fix RHSA-2026:82354
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.20 cert-manager/cert-manager-operator-rhel9 1790272426, cert-manager/cert-manager-operator-rhel9 1790589855, cert-manager/jetstack-cert-manager-rhel9 1790223279, cert-manager/jetstack-cert-manager-rhel9 1790589912, cert-manager/cert-manager-istio-csr-rhel9 1790223719, cert-manager/cert-manager-istio-csr-rhel9 1790589914, +2 more
    fixed: vendor fix RHSA-2026:72475
  • Red Hat Discovery 2 discovery/discovery-server-rhel9 1788205779
    fixed: vendor fix RHSA-2026:61783
  • Red Hat Enterprise Linux AppStream (v. 8) libxml2-devel 2.9.7-21.el8_10.7, libxml2-debuginfo 2.9.7-21.el8_10.7, libxml2-debugsource 2.9.7-21.el8_10.7, python3-libxml2-debuginfo 2.9.7-21.el8_10.7
    fixed: vendor fix RHSA-2026:61248
  • Red Hat Enterprise Linux AppStream (v. 9) libxml2-devel 2.9.13-14.el9_8.4, libxml2-debuginfo 2.9.13-14.el9_8.4, libxml2-debugsource 2.9.13-14.el9_8.4, python3-libxml2-debuginfo 2.9.13-14.el9_8.4
    fixed: vendor fix RHSA-2026:61247
  • Red Hat Enterprise Linux AppStream (v. 10) libxml2-devel 2.12.5-10.el10_2.3, libxml2-debuginfo 2.12.5-10.el10_2.3, libxml2-debugsource 2.12.5-10.el10_2.3, python3-libxml2-debuginfo 2.12.5-10.el10_2.3
    fixed: vendor fix RHSA-2026:60394
show 28 more
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) libxml2-devel 2.9.7-9.el8_4.20, libxml2-debuginfo 2.9.7-9.el8_4.20, libxml2-debugsource 2.9.7-9.el8_4.20, python3-libxml2-debuginfo 2.9.7-9.el8_4.20
    fixed: vendor fix RHSA-2026:93473
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) libxml2-devel 2.9.7-13.el8_6.24, libxml2-debuginfo 2.9.7-13.el8_6.24, libxml2-debugsource 2.9.7-13.el8_6.24, python3-libxml2-debuginfo 2.9.7-13.el8_6.24
    fixed: vendor fix RHSA-2026:92589
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) libxml2-devel 2.9.7-16.el8_8.24, libxml2-debuginfo 2.9.7-16.el8_8.24, libxml2-debugsource 2.9.7-16.el8_8.24, python3-libxml2-debuginfo 2.9.7-16.el8_8.24
    fixed: vendor fix RHSA-2026:93463
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) libxml2-devel 2.9.13-3.el9_2.20, libxml2-debuginfo 2.9.13-3.el9_2.20, libxml2-debugsource 2.9.13-3.el9_2.20, python3-libxml2-debuginfo 2.9.13-3.el9_2.20
    fixed: vendor fix RHSA-2026:92352
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) libxml2-devel 2.9.13-13.el9_4.10, libxml2-debuginfo 2.9.13-13.el9_4.10, libxml2-debugsource 2.9.13-13.el9_4.10, python3-libxml2-debuginfo 2.9.13-13.el9_4.10
    fixed: vendor fix RHSA-2026:89750
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) libxml2-devel 2.12.5-9.el10_0.9, libxml2-debuginfo 2.12.5-9.el10_0.9, libxml2-debugsource 2.12.5-9.el10_0.9, python3-libxml2-debuginfo 2.12.5-9.el10_0.9
    fixed: vendor fix RHSA-2026:89759
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) libxml2-devel 2.9.13-13.el9_6, libxml2-debuginfo 2.9.13-13.el9_6, libxml2-debugsource 2.9.13-13.el9_6, python3-libxml2-debuginfo 2.9.13-13.el9_6
    fixed: vendor fix RHSA-2026:90309
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) libxml2-devel 2.9.7-9.el8_4.20, libxml2-debuginfo 2.9.7-9.el8_4.20, libxml2-debugsource 2.9.7-9.el8_4.20, python3-libxml2-debuginfo 2.9.7-9.el8_4.20
    fixed: vendor fix RHSA-2026:93473
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) libxml2-devel 2.9.7-13.el8_6.24, libxml2-debuginfo 2.9.7-13.el8_6.24, libxml2-debugsource 2.9.7-13.el8_6.24, python3-libxml2-debuginfo 2.9.7-13.el8_6.24
    fixed: vendor fix RHSA-2026:92589
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) libxml2-devel 2.9.7-16.el8_8.24, libxml2-debuginfo 2.9.7-16.el8_8.24, libxml2-debugsource 2.9.7-16.el8_8.24, python3-libxml2-debuginfo 2.9.7-16.el8_8.24
    fixed: vendor fix RHSA-2026:93463
  • Red Hat Enterprise Linux BaseOS (v. 8) libxml2 2.9.7-21.el8_10.7, python3-libxml2 2.9.7-21.el8_10.7
    fixed: vendor fix RHSA-2026:61248
  • Red Hat Enterprise Linux BaseOS (v. 9) libxml2 2.9.13-14.el9_8.4, python3-libxml2 2.9.13-14.el9_8.4
    fixed: vendor fix RHSA-2026:61247
  • Red Hat Enterprise Linux BaseOS (v. 10) libxml2 2.12.5-10.el10_2.3, python3-libxml2 2.12.5-10.el10_2.3
    fixed: vendor fix RHSA-2026:60394
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) libxml2 2.9.7-9.el8_4.20, python3-libxml2 2.9.7-9.el8_4.20
    fixed: vendor fix RHSA-2026:93473
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) libxml2 2.9.7-13.el8_6.24, python3-libxml2 2.9.7-13.el8_6.24
    fixed: vendor fix RHSA-2026:92589
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8) libxml2 2.9.7-16.el8_8.24, python3-libxml2 2.9.7-16.el8_8.24
    fixed: vendor fix RHSA-2026:93463
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) libxml2 2.9.13-3.el9_2.20, python3-libxml2 2.9.13-3.el9_2.20
    fixed: vendor fix RHSA-2026:92352
  • Red Hat Enterprise Linux BaseOS E4S (v.9.4) libxml2 2.9.13-13.el9_4.10, python3-libxml2 2.9.13-13.el9_4.10
    fixed: vendor fix RHSA-2026:89750
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) libxml2 2.12.5-9.el10_0.9, python3-libxml2 2.12.5-9.el10_0.9
    fixed: vendor fix RHSA-2026:89759
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6) libxml2 2.9.13-13.el9_6, python3-libxml2 2.9.13-13.el9_6
    fixed: vendor fix RHSA-2026:90309
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) libxml2 2.9.7-9.el8_4.20, python3-libxml2 2.9.7-9.el8_4.20
    fixed: vendor fix RHSA-2026:93473
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) libxml2 2.9.7-13.el8_6.24, python3-libxml2 2.9.7-13.el8_6.24
    fixed: vendor fix RHSA-2026:92589
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8) libxml2 2.9.7-16.el8_8.24, python3-libxml2 2.9.7-16.el8_8.24
    fixed: vendor fix RHSA-2026:93463
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libxml2-static 2.12.5-10.el10_2.3, libxml2-debuginfo 2.12.5-10.el10_2.3, libxml2-debugsource 2.12.5-10.el10_2.3, python3-libxml2-debuginfo 2.12.5-10.el10_2.3
    fixed: vendor fix RHSA-2026:60394
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) libxml2-static 2.12.5-9.el10_0.9, libxml2-debuginfo 2.12.5-9.el10_0.9, libxml2-debugsource 2.12.5-9.el10_0.9, python3-libxml2-debuginfo 2.12.5-9.el10_0.9
    fixed: vendor fix RHSA-2026:89759
  • Red Hat Hardened Images libxml2 2.15.3-0.1.1.hum1, libxml2-16 2.15.3-0.1.1.hum1, python3-libxml2 2.15.3-0.1.1.hum1
    fixed: vendor fix RHSA-2026:33840
  • Red Hat OpenShift AI 3.0 rhai/base-image-cpu-rhel9 1793042072, rhai/base-image-cpu-rhel9 1793329709, rhai/base-image-tpu-rhel9 1793041987, rhai/base-image-cuda-rhel9 1793042067, rhai/base-image-cuda-rhel9 1793328358, rhai/base-image-rocm-rhel9 1793041981, +1 more
    fixed: vendor fix RHSA-2026:94459
  • Red Hat OpenShift AI 3.4 rhai/base-image-cpu-rhel9 1793042088, rhai/base-image-tpu-rhel9 1793042006, rhai/base-image-gaudi-rhel9 1793042011, rhai/base-image-spyre-rhel9 1793042074, rhai/base-image-neuron-rhel9 1793042008, rhai/base-image-rocm-6.4-rhel9 1793041995, +4 more
    fixed: vendor fix RHSA-2026:91241

2 more fixed, 3 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.15% chance of exploitation in the next 30 days, higher than 4% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 1.8 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N
CNA 4.0 1.8 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

  • xmlsoft libxml2

Classification

Weakness
  • CWE-121 Stack-based Buffer Overflow

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.