CVE-2026-86141: 
NixOS 취약성 분석 및 완화

CVE-2026-86141 is a NULL pointer dereference vulnerability in the xmlregexp component of libxml2 before version 2.15.4. The flaw exists in the xmlRegNewParserCtxt function, which fails to calculate a string length after a NULL check following a strdup failure — meaning if xmlStrdup returns NULL due to a memory allocation failure, the code proceeds to call strlen on the NULL pointer. It affects all versions of libxml2 prior to 2.15.4 and was publicly disclosed on September 5, 2026. The CVSS v3.1 base score is 3.3 (Low) (GitHub Advisory, Feedly).

The root cause is classified as CWE-252 (Unchecked Return Value). In xmlregexp.c, the xmlRegNewParserCtxt function calls xmlStrdup(string) and assigns the result to ret->string, then immediately calls strlen((const char *) ret->string) to set ret->len — before checking whether ret->string is NULL. If xmlStrdup fails due to memory pressure, ret->string is NULL and the subsequent strlen call dereferences a NULL pointer, causing a crash. The fix (commit e89a8aa) reorders the operations so that strlen is only called after the NULL check confirms ret->string is valid (GitHub Commit, GitLab Issue). The attack vector is local, requiring low privileges, and exploitation depends on triggering a memory allocation failure during XML regular expression parsing.

Successful exploitation results in a denial of service — specifically, a crash of the application or service using libxml2 for XML processing with regular expressions. The impact is limited to availability (low), with no confidentiality or integrity consequences. Only applications that process XML content involving regular expressions (e.g., XML Schema validation) are at risk, and the crash requires an underlying memory allocation failure to occur (Feedly, GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is approximately 0.116%, reflecting a very low probability of exploitation in the near term. The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as non-automatable. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

The primary remediation is to upgrade libxml2 to version 2.15.4 or later, which contains the fix that reorders the NULL check before the strlen call in xmlRegNewParserCtxt (GitHub Commit, GitHub Advisory). Patches are available through the GNOME GitHub/GitLab repositories and via Microsoft's September 2026 Patch Tuesday update (Microsoft MSRC). As a temporary workaround, restrict local access to systems running vulnerable libxml2 versions and monitor applications using the library for unexpected crashes.

The vulnerability was included in Microsoft's September 2026 Patch Tuesday, which addressed 966 flaws in total, giving it some broader visibility in security media coverage (BleepingComputer). The vulnerability was also discussed on the oss-security mailing list (oss-sec). Given its low severity score and limited exploitability, community reaction has been minimal beyond routine patch tracking.