{"id":"CVE-2026-123202","kind":"vulnerability","aliases":["CVE-2026-123202"],"related":[],"title":"libnxml: long XML names overflow stack buffer, letting remote feeds crash parsers","description":"libnxml before 0.18.6 contains a stack-based buffer overflow vulnerability in src/nxml_parser.c that allows remote attackers to write past a 1024-byte stack buffer via long XML names. Attackers can supply XML or RSS feeds with a 1022-character element, attribute, DOCTYPE or entity name ending in a multi-byte UTF-8 character to crash parsing applications.","summary":"libnxml is a C library for parsing XML. A crafted XML or RSS feed with a very long element, attribute, DOCTYPE or entity name overflows a 1024-byte stack buffer, and the sources say this crashes the parsing application.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","libnxml","package","rss","xml"],"not_affected_if":["libnxml-not-used","trusted-input-only"],"how_to_check":"- Look for libnxml in your dependencies or build files, for example `pkg-config --modversion nxml` or the libnxml line in your package manifest.\n- Check whether the installed version is below `0.18.6`.\n- Note whether your application parses untrusted XML or RSS feeds with libnxml.","fix":"- libnxml: move to `0.18.6` or later (the sources name the fix as the release that patches the flaw).","status":"open","published_at":"2026-11-05T19:17:19+00:00","first_seen_at":"2026-11-05T19:40:36+00:00","triaged_at":"2026-11-05T19:42:39+00:00","updated_at":"2026-11-05T19:42:40+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T19:42:39Z","model":"claude-haiku-5-5","output":{"fix":"- libnxml: move to `0.18.6` or later (the sources name the fix as the release that patches the flaw).","reach":"network","title":"libnxml: long XML names overflow stack buffer, letting remote feeds crash parsers","impact":"medium","summary":"libnxml is a C library for parsing XML. A crafted XML or RSS feed with a very long element, attribute, DOCTYPE or entity name overflows a 1024-byte stack buffer, and the sources say this crashes the parsing application.","audience":"developers","category":"package","nicknames":[],"who_cares":["libnxml","c","xml","rss"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Parsing application crashes when it reads a crafted feed","analyst_note":"Confirm from the patch commit or release notes whether any memory-corruption path beyond a crash exists, and whether the fixed version is 0.18.6 for all branches.","how_to_check":"- Look for libnxml in your dependencies or build files, for example `pkg-config --modversion nxml` or the libnxml line in your package manifest.\n- Check whether the installed version is below `0.18.6`.\n- Note whether your application parses untrusted XML or RSS feeds with libnxml.","plain_action":"","needs_analyst":true,"not_affected_if":["trusted-input-only","libnxml-not-used"],"who_is_affected":"Applications that link libnxml and parse XML or RSS from sources they do not control are exposed, since a single feed can crash them. Systems that only parse trusted, internal XML are less exposed. The sources describe a crash; they do not say code execution is possible.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000734,"input_tokens":4317,"output_tokens":605,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123202':15A,18A '-2026':14A,17A '-8':116C '0.18.6':65C '1022':101C '1024':50B,84C 'allow':77C 'applic':62B,121C 'attack':79C,92C 'attribut':43B,104C 'base':70C 'buffer':7A,53B,71C,87C 'byte':51B,85C,114C 'c':19B,27B 'charact':102C,117C 'contain':66C 'craft':33B 'crash':11A,59B,119C 'cve':13A,16A 'doctyp':44B,105C 'element':42B,103C 'end':109C 'entiti':46B,107C 'feed':10A,37B,98C 'let':8A 'libnxml':1A,20B,24B,63C 'librari':28B 'long':2A,41B,89C 'multi':113C 'multi-byt':112C 'name':4A,47B,91C,108C 'overflow':5A,48B,72C 'packag':21B 'pars':30B,61B,120C 'parser':12A 'past':82C 'remot':9A,78C 'rss':22B,36B,97C 'say':57B 'sourc':56B 'src/nxml_parser.c':75C 'stack':6A,52B,69C,86C 'stack-bas':68C 'suppli':94C 'utf':115C 'via':88C 'vulner':73C 'write':81C 'xml':3A,23B,31B,34B,90C,95C","nicknames":[],"mitigations":[],"who_affected":"Applications that link libnxml and parse XML or RSS from sources they do not control are exposed, since a single feed can crash them. Systems that only parse trusted, internal XML are less exposed. The sources describe a crash; they do not say code execution is possible.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["c","high","libnxml","package","rss","xml"],"campaign_type":null,"first_public_at":"2026-11-05T19:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123202","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123202","severity":null,"published_at":"2026-11-05T19:17:19+00:00","modified_at":"2026-11-05T19:17:19+00:00","first_seen_at":"2026-11-05T19:40:36+00:00","fetched_at":"2026-11-05T19:40:36+00:00","note":null}],"documents":[{"id":79197,"url":"https://github.com/bakulf/libnxml/commit/fbac242374883edf2ec14127ca6d2accf4704b6a","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79198,"url":"https://github.com/bakulf/libnxml/releases/tag/0.18.6","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79199,"url":"https://www.vulncheck.com/advisories/libnxml-before-0.18.6-stack-based-buffer-overflow-via-long-multi-byte-xml-name","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}