CVE-2026-11979

Name of the Vulnerable Software and Affected Versions libxml2 (affected versions not specified)

Description The xmlcatalog utility is susceptible to multiple stack-based buffer overflows when operating in --shell mode. The usershell() function processes user input using fixed-size stack buffers without adequate bounds checking. An attacker can trigger memory corruption within the stack frame by providing an excessively long input line, which overflows the command, arg, and argv internal buffers during parsing. This may lead to a process crash or arbitrary code execution within the context of the xmlcatalog process.

Recommendations Apply the fix provided in commit c2e233fc. As a temporary mitigation, avoid running the xmlcatalog utility in --shell mode.