CVE-2026-86143

Name of the Vulnerable Software and Affected Versions libxml2 versions prior to 2.15.4

Description An inconsistency between xmlOutputWriteCallback and xmlBufUse in the xmlIO component allows negative lengths to reach write callbacks due to a missing integer overflow check before the writecallback function is called. This issue can impact security depending on how the length value is utilized within the callback.

Recommendations Update to version 2.15.4 or later.