xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.

An update of the libxml2 package has been released.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup
    failure, i.e., it does not calculate a string length after NULL checking. (CVE-2026-86141)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1789668422 advisory.

  - In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
    (CVE-2026-86140)

  - xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup     failure, i.e., it does not calculate a string length after NULL checking. (CVE-2026-86141)

  - In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of     xmlXPtrEval xpointer length saturation. (CVE-2026-86142)

  - In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes     negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling     writecallback. This has security relevance for many types of uses of that length value within a callback.
    (CVE-2026-86143)

  - In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate     parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a     custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial     of service (e.g., for an attacker-controlled internet resource that is intentionally slow).
    (CVE-2026-86144)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1789780589 advisory.

  - In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
    (CVE-2026-86140)

  - xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup     failure, i.e., it does not calculate a string length after NULL checking. (CVE-2026-86141)

  - In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of     xmlXPtrEval xpointer length saturation. (CVE-2026-86142)

  - In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes     negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling     writecallback. This has security relevance for many types of uses of that length value within a callback.
    (CVE-2026-86143)

  - In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate     parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a     custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial     of service (e.g., for an attacker-controlled internet resource that is intentionally slow).
    (CVE-2026-86144)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1789668093 advisory.

  - In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
    (CVE-2026-86140)

  - xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup     failure, i.e., it does not calculate a string length after NULL checking. (CVE-2026-86141)

  - In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of     xmlXPtrEval xpointer length saturation. (CVE-2026-86142)

  - In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes     negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling     writecallback. This has security relevance for many types of uses of that length value within a callback.
    (CVE-2026-86143)

  - In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate     parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a     custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial     of service (e.g., for an attacker-controlled internet resource that is intentionally slow).
    (CVE-2026-86144)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup     failure, i.e., it does not calculate a string length after NULL checking. (CVE-2026-86141)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
375009	Photon OS 5.0: Libxml2 PHSA-2026-5.0-91-1002	Nessus	PhotonOS Local Security Checks	Local	high
374971	Photon OS 5.0: Libxml2 PHSA-2026-5.0-92-1002	Nessus	PhotonOS Local Security Checks	Local	high
374269	Nessus Network Monitor < 6.6.0 Multiple Vulnerabilities (TNS-2026-32)	Nessus	Misc.	Local	high
464500	Echo: libxml2: security update to 2.12.7+dfsg+really2.9.14-2.1+deb13u3+e1libxml2-2.15.3: security update to 2.15.3+e1	Tenable Cloud Security	Echo Local Security Checks	Local	low
464500	Echo: libxml2: security update to 2.12.7+dfsg+really2.9.14-2.1+deb13u3+e1libxml2-2.15.3: security update to 2.15.3+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
362044	CentOS Linux 8.4 [TuxCare] Security Update: libxml2 / libxml2-devel / libxml2-static / python3-libxml2 Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1789668422)	Nessus	CentOS Local Security Checks	Local	high
360981	CentOS Linux 8 [TuxCare] Security Update: libxml2 / libxml2-devel / libxml2-static / python3-libxml2 Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1789780589)	Nessus	CentOS Local Security Checks	Local	high
360165	CentOS Linux 8.5 [TuxCare] Security Update: libxml2 / libxml2-devel / libxml2-static / python3-libxml2 Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1789668093)	Nessus	CentOS Local Security Checks	Local	high
343096	Linux Distros Unpatched Vulnerability : CVE-2026-86141	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-86141

low

Tenable Plugins

high

high

high

low

low

high

high

high

low