CVE-2026-123202 · Package
NO FIX YET · SEE WHAT TO DO
libnxml is a C library for parsing XML. A crafted XML or RSS feed with a very long element, attribute, DOCTYPE or entity name overflows a 1024-byte stack buffer, and the sources say this crashes the parsing application.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that link libnxml and parse XML or RSS from sources they do not control are exposed, since a single feed can crash them. Systems that only parse trusted, internal XML are less exposed. The sources describe a crash; they do not say code execution is possible.
Not affected if libnxml-not-used, trusted-input-only
Who cares c, libnxml, rss, xml
pkg-config --modversion nxml or the libnxml line in your package manifest.0.18.6.0.18.6 or later (the sources name the fix as the release that patches the flaw).libnxml before 0.18.6 contains a stack-based buffer overflow vulnerability in src/nxml_parser.c that allows remote attackers to write past a 1024-byte stack buffer via long XML names. Attackers can supply XML or RSS feeds with a 1022-character element, attribute, DOCTYPE or entity name ending in a multi-byte UTF-8 character to crash parsing applications.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.