In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in
    the NXT macro in xmlregexp. (CVE-2026-86137)

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3940 advisory.

    A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this     vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD)     with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback     handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a     reproducible crash in Python applications using the libxml2 SAX bindings. (CVE-2026-74860)

    In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in     the NXT macro in xmlregexp. (CVE-2026-86137)

    In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based     buffer overflow. (CVE-2026-86138)

    In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
    (CVE-2026-86140)

    In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of     xmlXPtrEval xpointer length saturation. (CVE-2026-86142)

    In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes     negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling     writecallback. This has security relevance for many types of uses of that length value within a callback.
    (CVE-2026-86143)

    In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate     parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a     custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial     of service (e.g., for an attacker-controlled internet resource that is intentionally slow).
    (CVE-2026-86144)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in     the NXT macro in xmlregexp. (CVE-2026-86137)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
455133	Echo: libxml2: security update to 2.12.7+dfsg+really2.9.14-2.1+deb13u3+e1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
455133	Echo: libxml2: security update to 2.12.7+dfsg+really2.9.14-2.1+deb13u3+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
351063	Amazon Linux 2 : libxml2 (ALAS-2026-3940)	Nessus	Amazon Linux Local Security Checks	Local	high
343099	Linux Distros Unpatched Vulnerability : CVE-2026-86137	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-86137

medium

Tenable Plugins

medium

medium

high

medium