CVE-2026-86143: 
NixOS 취약성 분석 및 완화

CVE-2026-86143 is an integer overflow vulnerability in the xmlIO component of libxml2 affecting all versions before 2.15.4. An inconsistency between xmlOutputWriteCallback and xmlBufUse allows negative lengths to be passed to write callbacks due to a missing integer overflow check, classified under CWE-190 (Integer Overflow or Wraparound) and CWE-192 (Integer Coercion Error). The vulnerability was published on September 5, 2026, with a patch released in libxml2 2.15.4. It carries a CVSS v3.1 base score of 7.3 (High) per NVD, though ENISA scores it at 6.9 (Medium) (GitHub Advisory, Microsoft MSRC).

The root cause lies in xmlIO.c within libxml2's output buffer handling functions xmlOutputBufferWrite and xmlOutputBufferFlush. The xmlBufUse() function returns a size_t value, which when passed directly to write callbacks expecting an int parameter, can wrap around to a negative value if the buffer size exceeds INT_MAX, constituting an integer coercion error (CWE-192) and integer overflow (CWE-190). The fix (commit 90f293b) adds explicit checks — if nbchars >= INT_MAX or bufsize >= INT_MAX, the function sets an internal error and returns -1 before invoking the write callback. Exploitation requires local access with low privileges and no user interaction, and the attack vector is local (GitHub Commit, GitHub Advisory).

A local low-privileged user can trigger this vulnerability by providing specially crafted input that causes integer overflow in libxml2's buffer handling, potentially leading to high confidentiality and integrity impact (e.g., arbitrary file write or code execution) and limited availability impact (application crash). The NVD SSVC assessment classifies the technical impact as "total," indicating the potential for full compromise of affected applications using libxml2's output handling. Any application or library that uses libxml2's xmlIO output functionality — a widely deployed XML parsing library used across Linux distributions, macOS, and Windows software — is potentially affected (GitHub Advisory, Red Hat CVE).

As of the time of reporting, there is no confirmed public proof-of-concept exploit code and no evidence of in-the-wild exploitation. The NVD SSVC assessment marks exploitation as "none" and the vulnerability as not automatable, reflecting the local access requirement. The EPSS score is approximately 0.00119 (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A GitLab work item (work_items/1111) is referenced but contains no exploit material (GitHub Advisory, Feedly Intelligence).

The primary remediation is to upgrade libxml2 to version 2.15.4 or later, which includes the fix in commit 90f293b that adds integer overflow checks before invoking write callbacks in xmlOutputBufferWrite and xmlOutputBufferFlush. Organizations unable to upgrade immediately should restrict local user privileges on systems running applications that use libxml2's xmlIO output functionality, and monitor application logs for unexpected internal errors or crashes related to buffer handling. Patches are available through the GNOME/libxml2 GitHub repository, Red Hat, and Microsoft's September 2026 Patch Tuesday update (GitHub Commit, Red Hat CVE, Microsoft MSRC).

The vulnerability was included in Microsoft's September 2026 Patch Tuesday, which addressed 966 flaws total, giving it broader visibility in the security community (BleepingComputer). Red Hat has acknowledged the vulnerability and published a CVE page. Coverage has been largely routine, with no notable researcher commentary or significant social media discussion, consistent with the low EPSS score and absence of active exploitation.