CVE-2026-86143: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-86143 is an integer coercion/overflow vulnerability in the xmlIO component of libxml2 that allows negative lengths to reach write callbacks due to an inconsistency between xmlOutputWriteCallback and xmlBufUse. All versions of libxml2 before 2.15.4 are affected. The vulnerability was published on September 5, 2026, with a patch released in libxml2 v2.15.4. It carries a CVSS v3.1 base score of 6.9 (Medium) (GitHub Advisory).

The root cause is classified as CWE-192 (Integer Coercion Error): the xmlOutputBufferWrite and xmlOutputBufferFlush functions in xmlIO.c pass the result of xmlBufUse() — which returns a size_t — directly to write callbacks expecting a signed int, without first checking whether the value exceeds INT_MAX. This truncation/coercion can produce a negative length value that is then passed to the write callback, where it may be interpreted as a large unsigned value or cause out-of-bounds memory access depending on callback implementation. The fix, applied in commit 90f293b, adds explicit checks for bufsize >= INT_MAX before invoking the write callback, returning XML_ERR_INTERNAL_ERROR if the condition is met (libxml2 commit, GitHub Advisory).

A local, unprivileged attacker who can influence XML processing operations may trigger this vulnerability to cause memory disclosure or memory corruption, depending on how the affected write callback uses the negative length value. The confidentiality and integrity impacts are rated High, meaning sensitive data could be read from memory or memory contents could be corrupted, while availability impact is Low. The security relevance varies widely based on the specific write callback implementation in the consuming application (GitHub Advisory).

As of the disclosure date (September 5, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access and high attack complexity, limiting the practical attack surface (GitHub Advisory).

Update libxml2 to version 2.15.4 or later, which includes the fix in commit 90f293b that adds integer overflow checks before invoking write callbacks. As a temporary workaround where patching is not immediately possible, consider sandboxing XML processing operations to limit the impact of exploitation, and implement input validation and bounds checking for XML processing inputs. No configuration-only workaround is available (libxml2 commit, GitHub Advisory).