Is CVE-2026-86141 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-86141?

CVE-2026-86141 has a CVSS v3 severity of LOW (2.9).

Back

CVE-2026-86141

Description

xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.