CVE-2026-86141: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-86141 is a NULL pointer dereference vulnerability in the xmlregexp component of libxml2 affecting all versions before 2.15.4. The flaw exists in the xmlRegNewParserCtxt function, which fails to calculate a string length after a NULL check following a strdup failure. It was published on September 5, 2026, with a patch released in libxml2 version 2.15.4. The vulnerability carries a CVSS v3.1 base score of 2.9 (Low) (GitHub Advisory).

The root cause is an unchecked return value (CWE-252): after calling xmlStrdup(string), the code originally computed ret->len = strlen((const char *) ret->string) before checking whether xmlStrdup returned NULL, meaning a failed memory allocation could result in a NULL pointer dereference when strlen is subsequently called on a NULL pointer. The fix, applied in commit e89a8aa, reorders the operations so that the NULL check on ret->string occurs before strlen is invoked (libxml2 commit). Exploitation requires a local attacker to trigger a memory allocation failure during XML regular expression parsing, making the attack complexity high and the attack vector local (GitHub Advisory).

Successful exploitation results in an application crash (denial of service) due to the NULL pointer dereference in xmlRegNewParserCtxt. There is no impact on confidentiality or integrity; only availability is affected at a low level, limited to the process consuming the vulnerable libxml2 library. The scope is unchanged, meaning the impact is confined to the affected component and does not enable lateral movement or data exposure (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity (requiring a memory allocation failure to be triggered) further limits practical exploitability.

Update libxml2 to version 2.15.4 or later, which contains the fix that reorders the NULL check and strlen call in xmlRegNewParserCtxt (libxml2 commit, GitHub Advisory). As a secondary measure, limit local access to systems running vulnerable versions of libxml2 where an immediate upgrade is not feasible. No configuration-based workaround is documented; patching is the recommended remediation.