In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.

rocky_linux RLSA-2026:71641: RLSA-2026:71641: libxml2 security update (Important)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-71641 advisory.

    - Fix CVE-2026-86144 (RHEL-256306)
    - Fix CVE-2026-86140 (RHEL-256021)
    - Fix CVE-2026-74860 (RHEL-255956)
    - Fix CVE-2026-86143 (RHEL-256895)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:71585 advisory.

    * libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow (CVE-2026-86138)

    * libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks (CVE-2026-86143)

    * libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements     (CVE-2026-86140)

    * libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation     (CVE-2026-86142)

    * libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags     propagation. (CVE-2026-86144)

    * libxml2: double-free/UAF in libxml2 Python bindings (CVE-2026-74860)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-71586 advisory.

    - Fix CVE-2026-86144 (RHEL-256302)
    - Fix CVE-2026-86140 (RHEL-256024)
    - Fix CVE-2026-74860 (RHEL-255957)
    - Fix CVE-2026-86142 (RHEL-256368)
    - Fix CVE-2026-86143 (RHEL-256896)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-71585 advisory.

    - Fix CVE-2026-86144 (RHEL-256304)
    - Fix CVE-2026-86140 (RHEL-256027)
    - Fix CVE-2026-74860 (RHEL-256120)
    - Fix CVE-2026-86142 (RHEL-256365)
    - Fix CVE-2026-86143 (RHEL-256901)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:71586 advisory.

    * libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow (CVE-2026-86138)

    * libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks (CVE-2026-86143)

    * libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements     (CVE-2026-86140)

    * libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation     (CVE-2026-86142)

    * libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags     propagation. (CVE-2026-86144)

    * libxml2: double-free/UAF in libxml2 Python bindings (CVE-2026-74860)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71585 advisory.

    The libxml2 library is a development toolbox providing the implementation of various XML standards.

    Security Fix(es):

    * libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow (CVE-2026-86138)

    * libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks (CVE-2026-86143)

    * libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements     (CVE-2026-86140)

    * libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation     (CVE-2026-86142)

    * libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags     propagation. (CVE-2026-86144)

    * libxml2: double-free/UAF in libxml2 Python bindings (CVE-2026-74860)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71641 advisory.

    The libxml2 library is a development toolbox providing the implementation of various XML standards.

    Security Fix(es):

    * libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow (CVE-2026-86138)

    * libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks (CVE-2026-86143)

    * libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements     (CVE-2026-86140)

    * libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags     propagation. (CVE-2026-86144)

    * libxml2: double-free/UAF in libxml2 Python bindings (CVE-2026-74860)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71586 advisory.

    The libxml2 library is a development toolbox providing the implementation of various XML standards.

    Security Fix(es):

    * libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow (CVE-2026-86138)

    * libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks (CVE-2026-86143)

    * libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements     (CVE-2026-86140)

    * libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation     (CVE-2026-86142)

    * libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags     propagation. (CVE-2026-86144)

    * libxml2: double-free/UAF in libxml2 Python bindings (CVE-2026-74860)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes     negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling     writecallback. This has security relevance for many types of uses of that length value within a callback.
    (CVE-2026-86143)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
350754	Oracle Linux 8 : libxml2 (ELSA-2026-71641)	Nessus	Oracle Linux Local Security Checks	Local	high
350693	RockyLinux 9 : libxml2 (RLSA-2026:71585)	Nessus	Rocky Linux Local Security Checks	Local	high
350317	Oracle Linux 10 : libxml2 (ELSA-2026-71586)	Nessus	Oracle Linux Local Security Checks	Local	high
350316	Oracle Linux 9 : libxml2 (ELSA-2026-71585)	Nessus	Oracle Linux Local Security Checks	Local	high
350314	RockyLinux 10 : libxml2 (RLSA-2026:71586)	Nessus	Rocky Linux Local Security Checks	Local	high
349918	RHEL 9 : libxml2 (RHSA-2026:71585)	Nessus	Red Hat Local Security Checks	Local	high
349735	RHEL 8 : libxml2 (RHSA-2026:71641)	Nessus	Red Hat Local Security Checks	Local	high
349734	RHEL 10 : libxml2 (RHSA-2026:71586)	Nessus	Red Hat Local Security Checks	Local	high
343104	Linux Distros Unpatched Vulnerability : CVE-2026-86143	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-86143

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high