Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-86137

Fixed in a distro release EPSS <1%CVSS 2.9

In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.

Published 2026-09-05 · CVE record · OSV

Products: xmlsoft libxml2

Distro releases

ReleasePackageFixed in
Amazon Linux 2libxml22.9.1-6.amzn2.5.27
Amazon Linux 2libxml2-devel2.9.1-6.amzn2.5.27
Amazon Linux 2libxml2-python2.9.1-6.amzn2.5.27
Amazon Linux 2libxml2-static2.9.1-6.amzn2.5.27
Amazon Linux 2023libxml22.10.4-1.amzn2023.0.21
Amazon Linux 2023libxml2-devel2.10.4-1.amzn2023.0.21
Amazon Linux 2023libxml2-static2.10.4-1.amzn2023.0.21
Amazon Linux 2023python3-libxml22.10.4-1.amzn2023.0.21
Debian 13libxml2no fix
Debian 14libxml22.15.4+dfsg-1
Red Hat hummingbird 1libxml20:2.15.4-0.1.hum1
Red Hat hummingbird 1libxml2-160:2.15.4-0.1.hum1
Red Hat hummingbird 1libxml2-devel0:2.15.4-0.1.hum1
Red Hat hummingbird 1libxml2-static0:2.15.4-0.1.hum1
Red Hat hummingbird 1python3-libxml20:2.15.4-0.1.hum1