Description
A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.
Affected products
xmlsoft: libxml2; redhat: jboss core services; redhat: openshift container platform; redhat: openshift container platform for arm64; redhat: openshift container platform for ibm z; redhat: openshift container platform for linuxone; redhat: openshift container platform for power; redhat: enterprise linux; redhat: enterprise linux eus; redhat: enterprise linux for arm 64; redhat: enterprise linux for arm 64 eus; redhat: enterprise linux for ibm z systems; redhat: enterprise linux for ibm z systems eus; redhat: enterprise linux for power little endian; redhat: enterprise linux for power little endian eus
References10
- gitlab.gnome.org/GNOME/libxml2/-/issues/926 ExploitIssue TrackingVendor Advisory
- gitlab.gnome.org/GNOME/libxml2/-/issues/926 ExploitIssue TrackingVendor Advisory
- access.redhat.com/errata/RHSA-2025:10630 Third Party Advisory
- access.redhat.com/errata/RHSA-2025:10698 Third Party Advisory
- access.redhat.com/errata/RHSA-2025:10699 Third Party Advisory
- access.redhat.com/errata/RHSA-2025:11580 Third Party Advisory
- access.redhat.com/errata/RHSA-2025:11673
- access.redhat.com/errata/RHSA-2025:12098 Third Party Advisory
- access.redhat.com/errata/RHSA-2025:12099 Third Party Advisory
- access.redhat.com/errata/RHSA-2025:12199 Third Party Advisory
Metrics
- CVSS 3.1
-
7.5
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS — exploit probability
- 1% percentile: 72 · as of 7 November 2026
- CWE
- CWE-787
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.