CVE-2026-123202

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123202", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-05T17:58:50.610Z", "datePublished": "2026-11-05T18:16:38.397Z", "dateUpdated": "2026-11-05T19:04:52.864Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-05T18:16:38.397Z"}, "datePublic": "2026-10-29T00:00:00.000Z", "title": "libnxml before 0.18.6 Stack-based Buffer Overflow via long multi-byte XML name", "descriptions": [{"lang": "en", "value": "libnxml before 0.18.6 contains a stack-based buffer overflow vulnerability in src/nxml_parser.c that allows remote attackers to write past a 1024-byte stack buffer via long XML names. Attackers can supply XML or RSS feeds with a 1022-character element, attribute, DOCTYPE or entity name ending in a multi-byte UTF-8 character to crash parsing applications."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Stack-based Buffer Overflow", "cweId": "CWE-121", "type": "CWE"}]}], "affected": [{"vendor": "bakulf", "product": "libnxml", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "0.18.6", "status": "affected", "versionType": "semver"}], "packageURL": "pkg:github/bakulf/libnxml", "repo": "https://github.com/bakulf/libnxml"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/bakulf/libnxml/commit/fbac242374883edf2ec14127ca6d2accf4704b6a", "tags": ["patch"]}, {"url": "https://github.com/bakulf/libnxml/releases/tag/0.18.6", "tags": ["release-notes"], "name": "libnxml 0.18.6 Release Notes"}, {"url": "https://github.com/bakulf/libnxml/blob/9272d1cd6fee88fe7fd4fd812736d95a6ba25f2f/src/nxml_parser.c#L952-L958", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: libnxml before 0.18.6 Stack-based Buffer Overflow via long multi-byte XML name", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/libnxml-before-0.18.6-stack-based-buffer-overflow-via-long-multi-byte-xml-name"}], "credits": [{"lang": "en", "value": "Deus Rex", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T19:04:41.118484Z", "id": "CVE-2026-123202", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:04:52.864Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-123202", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T19:04:41.118484Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:04:47.366Z"}}], "cna": {"title": "libnxml before 0.18.6 Stack-based Buffer Overflow via long multi-byte XML name", "credits": [{"lang": "en", "type": "finder", "value": "Deus Rex"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"repo": "https://github.com/bakulf/libnxml", "vendor": "bakulf", "product": "libnxml", "versions": [{"status": "affected", "version": "0", "lessThan": "0.18.6", "versionType": "semver"}], "packageURL": "pkg:github/bakulf/libnxml", "defaultStatus": "unaffected"}], "datePublic": "2026-10-29T00:00:00.000Z", "references": [{"url": "https://github.com/bakulf/libnxml/commit/fbac242374883edf2ec14127ca6d2accf4704b6a", "tags": ["patch"]}, {"url": "https://github.com/bakulf/libnxml/releases/tag/0.18.6", "name": "libnxml 0.18.6 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/bakulf/libnxml/blob/9272d1cd6fee88fe7fd4fd812736d95a6ba25f2f/src/nxml_parser.c#L952-L958", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/libnxml-before-0.18.6-stack-based-buffer-overflow-via-long-multi-byte-xml-name", "name": "VulnCheck Advisory: libnxml before 0.18.6 Stack-based Buffer Overflow via long multi-byte XML name", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "libnxml before 0.18.6 contains a stack-based buffer overflow vulnerability in src/nxml_parser.c that allows remote attackers to write past a 1024-byte stack buffer via long XML names. Attackers can supply XML or RSS feeds with a 1022-character element, attribute, DOCTYPE or entity name ending in a multi-byte UTF-8 character to crash parsing applications."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "Stack-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-05T18:16:38.397Z"}}}, "cveMetadata": {"cveId": "CVE-2026-123202", "state": "PUBLISHED", "dateUpdated": "2026-11-05T19:04:52.864Z", "dateReserved": "2026-11-05T17:58:50.610Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-11-05T18:16:38.397Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/bakulf/libnxml", "product": "libnxml", "repo": "https://github.com/bakulf/libnxml", "vendor": "bakulf", "versions": [{"lessThan": "0.18.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "libnxml before 0.18.6 contains a stack-based buffer overflow vulnerability in src/nxml_parser.c that allows remote attackers to write past a 1024-byte stack buffer via long XML names. Attackers can supply XML or RSS feeds with a 1022-character element, attribute, DOCTYPE or entity name ending in a multi-byte UTF-8 character to crash parsing applications."}], "id": "CVE-2026-123202", "lastModified": "2026-11-12T21:36:06.743", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-123202", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T19:04:41.118484Z", "version": "2.0.3"}}]}, "published": "2026-11-05T19:17:19.337", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/bakulf/libnxml/blob/9272d1cd6fee88fe7fd4fd812736d95a6ba25f2f/src/nxml_parser.c#L952-L958"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/bakulf/libnxml/commit/fbac242374883edf2ec14127ca6d2accf4704b6a"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/bakulf/libnxml/releases/tag/0.18.6"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/libnxml-before-0.18.6-stack-based-buffer-overflow-via-long-multi-byte-xml-name"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{"bugzilla": {"description": "libnxml: libnxml: Denial of Service via stack-based buffer overflow", "id": "2567801", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567801"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in libnxml. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by crashing applications that process untrusted data. By supplying specially crafted XML or RSS feeds containing excessively long names ending in multi-byte characters, an attacker can trigger a stack-based buffer overflow in the parser component, leading to an application crash."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-123202", "public_date": "2026-11-05T18:16:38Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-123202\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-123202\nhttps://github.com/bakulf/libnxml/blob/9272d1cd6fee88fe7fd4fd812736d95a6ba25f2f/src/nxml_parser.c#L952-L958\nhttps://github.com/bakulf/libnxml/commit/fbac242374883edf2ec14127ca6d2accf4704b6a\nhttps://github.com/bakulf/libnxml/releases/tag/0.18.6\nhttps://www.vulncheck.com/advisories/libnxml-before-0.18.6-stack-based-buffer-overflow-via-long-multi-byte-xml-name"], "statement": "This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker can cause a denial of service by triggering an application crash without requiring user interaction. Applications consuming untrusted XML feeds or documents via this parser library can be terminated unexpectedly when processing specially crafted input. While stack corruption occurs, the primary demonstrated impact is denial of service against services that process untrusted network inputs.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.18.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "libnxml", "source": "cna", "vendor": "bakulf"}, "product": "libnxml", "vendor": "bakulf"}], "created": "2026-11-05T20:00:09.809251+00:00", "updated": "2026-11-06T16:35:32.490904+00:00", "vendors": ["bakulf", "bakulf$PRODUCT$libnxml"]}