Vulnerability · Published Nov 5, 2026 · Assigned by VulnCheck
CVE-2026-123202libnxml before 0.18.6 Stack-based Buffer Overflow via long multi-byte XML name
High 7.5
In plain English
A high-severity stack buffer overflow in libnxml from bakulf. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 46.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
libnxml before 0.18.6 contains a stack-based buffer overflow vulnerability in src/nxml_parser.c that allows remote attackers to write past a 1024-byte stack buffer via long XML names. Attackers can supply XML or RSS feeds with a 1022-character element, attribute, DOCTYPE or entity name ending in a multi-byte UTF-8 character to crash parsing applications.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libnxml | no fix listed | DEBIAN-CVE-2026-123202 |
| Debian:13 | libnxml | no fix listed | DEBIAN-CVE-2026-123202 |
| Debian:14 | libnxml | no fix listed | DEBIAN-CVE-2026-123202 |
| Ubuntu:22.04:LTS | libnxml | no fix listed | UBUNTU-CVE-2026-123202 |
| Ubuntu:24.04:LTS | libnxml | no fix listed | UBUNTU-CVE-2026-123202 |
| Ubuntu:26.04:LTS | libnxml | no fix listed | UBUNTU-CVE-2026-123202 |
| Ubuntu:26.10 | libnxml | no fix listed | UBUNTU-CVE-2026-123202 |
Affected products (as reported)
Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/bakulf/libnxml/commit/fbac242374883edf2ec14127ca6d2accf4704b6a patch
- libnxml 0.18.6 Release Notes release-notes
- https://github.com/bakulf/libnxml/blob/9272d1cd6fee88fe7fd4fd812736d95a6ba25f2f/src/nxml_parser.c#L952-L958 technical-description
- VulnCheck Advisory: libnxml before 0.18.6 Stack-based Buffer Overflow via long multi-byte XML name third-party-advisory