{"document":{"aggregate_severity":{"namespace":"https://access.redhat.com/security/updates/classification/","text":"Important"},"category":"csaf_vex","csaf_version":"2.0","distribution":{"text":"Copyright © Red Hat, Inc. All rights reserved.","tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en","notes":[{"category":"legal_disclaimer","text":"This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.","title":"Terms of Use"}],"publisher":{"category":"vendor","contact_details":"https://access.redhat.com/security/team/contact/","issuing_authority":"Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.","name":"Red Hat Product Security","namespace":"https://www.redhat.com"},"references":[{"category":"self","summary":"Canonical URL","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-86140.json"}],"title":"libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements","tracking":{"current_release_date":"2026-09-08T11:04:00+00:00","generator":{"date":"2026-09-08T11:04:00+00:00","engine":{"name":"Red Hat SDEngine","version":"5.3.16"}},"id":"CVE-2026-86140","initial_release_date":"2026-09-05T04:26:13.860000+00:00","revision_history":[{"date":"2026-09-05T04:26:13.860000+00:00","number":"1","summary":"Initial version"},{"date":"2026-09-08T08:58:37+00:00","number":"2","summary":"Current version"},{"date":"2026-09-08T11:04:00+00:00","number":"3","summary":"Last generated version"}],"status":"final","version":"3"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_name","name":"Red Hat Enterprise Linux 10","product":{"name":"Red Hat Enterprise Linux 10","product_id":"red_hat_enterprise_linux_10","product_identification_helper":{"cpe":"cpe:/o:redhat:enterprise_linux:10"}}}],"category":"product_family","name":"Red Hat Enterprise Linux 10"},{"branches":[{"category":"product_name","name":"Red Hat Enterprise Linux 6","product":{"name":"Red Hat Enterprise Linux 6","product_id":"red_hat_enterprise_linux_6","product_identification_helper":{"cpe":"cpe:/o:redhat:enterprise_linux:6"}}}],"category":"product_family","name":"Red Hat Enterprise Linux 6"},{"branches":[{"category":"product_name","name":"Red Hat Enterprise Linux 7","product":{"name":"Red Hat Enterprise Linux 7","product_id":"red_hat_enterprise_linux_7","product_identification_helper":{"cpe":"cpe:/o:redhat:enterprise_linux:7"}}}],"category":"product_family","name":"Red Hat Enterprise Linux 7"},{"branches":[{"category":"product_name","name":"Red Hat Enterprise Linux 8","product":{"name":"Red Hat Enterprise Linux 8","product_id":"red_hat_enterprise_linux_8","product_identification_helper":{"cpe":"cpe:/o:redhat:enterprise_linux:8"}}}],"category":"product_family","name":"Red Hat Enterprise Linux 8"},{"branches":[{"category":"product_name","name":"Red Hat Enterprise Linux 9","product":{"name":"Red Hat Enterprise Linux 9","product_id":"red_hat_enterprise_linux_9","product_identification_helper":{"cpe":"cpe:/o:redhat:enterprise_linux:9"}}}],"category":"product_family","name":"Red Hat Enterprise Linux 9"},{"branches":[{"category":"product_name","name":"Red Hat Hardened Images","product":{"name":"Red Hat Hardened Images","product_id":"red_hat_hardened_images","product_identification_helper":{"cpe":"cpe:/a:redhat:hummingbird:1"}}}],"category":"product_family","name":"Red Hat Hardened Images"},{"branches":[{"category":"product_name","name":"Red Hat OpenShift Container Platform 4","product":{"name":"Red Hat OpenShift Container Platform 4","product_id":"red_hat_openshift_container_platform_4","product_identification_helper":{"cpe":"cpe:/a:redhat:openshift:4"}}}],"category":"product_family","name":"Red Hat OpenShift Container Platform 4"},{"category":"product_version","name":"libxml2.src","product":{"name":"libxml2.src","product_id":"libxml2.src","product_identification_helper":{"purl":"pkg:rpm/redhat/libxml2?arch=src"}}},{"category":"product_version","name":"libxml2-static","product":{"name":"libxml2-static","product_id":"libxml2-static","product_identification_helper":{"purl":"pkg:rpm/redhat/libxml2-static"}}},{"category":"product_version","name":"libxml2","product":{"name":"libxml2","product_id":"libxml2","product_identification_helper":{"purl":"pkg:rpm/redhat/libxml2"}}},{"category":"product_version","name":"libxml2-devel","product":{"name":"libxml2-devel","product_id":"libxml2-devel","product_identification_helper":{"purl":"pkg:rpm/redhat/libxml2-devel"}}},{"category":"product_version","name":"python3-libxml2","product":{"name":"python3-libxml2","product_id":"python3-libxml2","product_identification_helper":{"purl":"pkg:rpm/redhat/python3-libxml2"}}},{"category":"product_version","name":"podman.src","product":{"name":"podman.src","product_id":"podman.src","product_identification_helper":{"purl":"pkg:rpm/redhat/podman?arch=src"}}},{"category":"product_version","name":"podman-remote","product":{"name":"podman-remote","product_id":"podman-remote","product_identification_helper":{"purl":"pkg:rpm/redhat/podman-remote"}}},{"category":"product_version","name":"podman-docker","product":{"name":"podman-docker","product_id":"podman-docker","product_identification_helper":{"purl":"pkg:rpm/redhat/podman-docker"}}},{"category":"product_version","name":"podman","product":{"name":"podman","product_id":"podman","product_identification_helper":{"purl":"pkg:rpm/redhat/podman"}}},{"category":"product_version","name":"podman-tests","product":{"name":"podman-tests","product_id":"podman-tests","product_identification_helper":{"purl":"pkg:rpm/redhat/podman-tests"}}},{"category":"product_version","name":"libxml2-python","product":{"name":"libxml2-python","product_id":"libxml2-python","product_identification_helper":{"purl":"pkg:rpm/redhat/libxml2-python"}}},{"category":"product_version","name":"podman.src::container-tools:rhel8","product":{"name":"podman.src (container-tools:rhel8)","product_id":"podman.src::container-tools:rhel8","product_identification_helper":{"purl":"pkg:rpm/redhat/podman?arch=src&rpmmod=container-tools:rhel8"}}},{"category":"product_version","name":"podman-remote::container-tools:rhel8","product":{"name":"podman-remote (container-tools:rhel8)","product_id":"podman-remote::container-tools:rhel8","product_identification_helper":{"purl":"pkg:rpm/redhat/podman-remote?rpmmod=container-tools:rhel8"}}},{"category":"product_version","name":"podman-catatonit::container-tools:rhel8","product":{"name":"podman-catatonit (container-tools:rhel8)","product_id":"podman-catatonit::container-tools:rhel8","product_identification_helper":{"purl":"pkg:rpm/redhat/podman-catatonit?rpmmod=container-tools:rhel8"}}},{"category":"product_version","name":"podman-docker::container-tools:rhel8","product":{"name":"podman-docker (container-tools:rhel8)","product_id":"podman-docker::container-tools:rhel8","product_identification_helper":{"purl":"pkg:rpm/redhat/podman-docker?rpmmod=container-tools:rhel8"}}},{"category":"product_version","name":"podman-tests::container-tools:rhel8","product":{"name":"podman-tests (container-tools:rhel8)","product_id":"podman-tests::container-tools:rhel8","product_identification_helper":{"purl":"pkg:rpm/redhat/podman-tests?rpmmod=container-tools:rhel8"}}},{"category":"product_version","name":"podman::container-tools:rhel8","product":{"name":"podman (container-tools:rhel8)","product_id":"podman::container-tools:rhel8","product_identification_helper":{"purl":"pkg:rpm/redhat/podman?rpmmod=container-tools:rhel8"}}},{"category":"product_version","name":"podman-gvproxy::container-tools:rhel8","product":{"name":"podman-gvproxy (container-tools:rhel8)","product_id":"podman-gvproxy::container-tools:rhel8","product_identification_helper":{"purl":"pkg:rpm/redhat/podman-gvproxy?rpmmod=container-tools:rhel8"}}},{"category":"product_version","name":"podman-manpages::container-tools:rhel8","product":{"name":"podman-manpages (container-tools:rhel8)","product_id":"podman-manpages::container-tools:rhel8","product_identification_helper":{"purl":"pkg:rpm/redhat/podman-manpages?rpmmod=container-tools:rhel8"}}},{"category":"product_version","name":"podman-plugins::container-tools:rhel8","product":{"name":"podman-plugins (container-tools:rhel8)","product_id":"podman-plugins::container-tools:rhel8","product_identification_helper":{"purl":"pkg:rpm/redhat/podman-plugins?rpmmod=container-tools:rhel8"}}},{"category":"product_version","name":"podman-catatonit","product":{"name":"podman-catatonit","product_id":"podman-catatonit","product_identification_helper":{"purl":"pkg:rpm/redhat/podman-catatonit"}}},{"category":"product_version","name":"podman-gvproxy","product":{"name":"podman-gvproxy","product_id":"podman-gvproxy","product_identification_helper":{"purl":"pkg:rpm/redhat/podman-gvproxy"}}},{"category":"product_version","name":"podman-plugins","product":{"name":"podman-plugins","product_id":"podman-plugins","product_identification_helper":{"purl":"pkg:rpm/redhat/podman-plugins"}}},{"category":"product_version","name":"swift-lang.src","product":{"name":"swift-lang.src","product_id":"swift-lang.src","product_identification_helper":{"purl":"pkg:rpm/redhat/swift-lang?arch=src"}}},{"category":"product_version","name":"openshift/ose-rhel-coreos-8","product":{"name":"openshift/ose-rhel-coreos-8","product_id":"openshift/ose-rhel-coreos-8","product_identification_helper":{"purl":"pkg:oci/ose-rhel-coreos-8?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-8"}}},{"category":"product_version","name":"openshift/ose-rhel-coreos-9","product":{"name":"openshift/ose-rhel-coreos-9","product_id":"openshift/ose-rhel-coreos-9","product_identification_helper":{"purl":"pkg:oci/ose-rhel-coreos-9?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-9"}}},{"category":"product_version","name":"podman-manpages","product":{"name":"podman-manpages","product_id":"podman-manpages","product_identification_helper":{"purl":"pkg:rpm/redhat/podman-manpages"}}}],"category":"vendor","name":"Red Hat"}],"relationships":[{"category":"default_component_of","full_product_name":{"name":"libxml2 as a component of Red Hat Enterprise Linux 10","product_id":"red_hat_enterprise_linux_10:libxml2"},"product_reference":"libxml2","relates_to_product_reference":"red_hat_enterprise_linux_10"},{"category":"default_component_of","full_product_name":{"name":"libxml2-devel as a component of Red Hat Enterprise Linux 10","product_id":"red_hat_enterprise_linux_10:libxml2-devel"},"product_reference":"libxml2-devel","relates_to_product_reference":"red_hat_enterprise_linux_10"},{"category":"default_component_of","full_product_name":{"name":"libxml2-static as a component of Red Hat Enterprise Linux 10","product_id":"red_hat_enterprise_linux_10:libxml2-static"},"product_reference":"libxml2-static","relates_to_product_reference":"red_hat_enterprise_linux_10"},{"category":"default_component_of","full_product_name":{"name":"libxml2.src as a component of Red Hat Enterprise Linux 10","product_id":"red_hat_enterprise_linux_10:libxml2.src"},"product_reference":"libxml2.src","relates_to_product_reference":"red_hat_enterprise_linux_10"},{"category":"default_component_of","full_product_name":{"name":"podman as a component of Red Hat Enterprise Linux 10","product_id":"red_hat_enterprise_linux_10:podman"},"product_reference":"podman","relates_to_product_reference":"red_hat_enterprise_linux_10"},{"category":"default_component_of","full_product_name":{"name":"podman-docker as a component of Red Hat Enterprise Linux 10","product_id":"red_hat_enterprise_linux_10:podman-docker"},"product_reference":"podman-docker","relates_to_product_reference":"red_hat_enterprise_linux_10"},{"category":"default_component_of","full_product_name":{"name":"podman-remote as a component of Red Hat Enterprise Linux 10","product_id":"red_hat_enterprise_linux_10:podman-remote"},"product_reference":"podman-remote","relates_to_product_reference":"red_hat_enterprise_linux_10"},{"category":"default_component_of","full_product_name":{"name":"podman-tests as a component of Red Hat Enterprise Linux 10","product_id":"red_hat_enterprise_linux_10:podman-tests"},"product_reference":"podman-tests","relates_to_product_reference":"red_hat_enterprise_linux_10"},{"category":"default_component_of","full_product_name":{"name":"podman.src as a component of Red Hat Enterprise Linux 10","product_id":"red_hat_enterprise_linux_10:podman.src"},"product_reference":"podman.src","relates_to_product_reference":"red_hat_enterprise_linux_10"},{"category":"default_component_of","full_product_name":{"name":"python3-libxml2 as a component of Red Hat Enterprise Linux 10","product_id":"red_hat_enterprise_linux_10:python3-libxml2"},"product_reference":"python3-libxml2","relates_to_product_reference":"red_hat_enterprise_linux_10"},{"category":"default_component_of","full_product_name":{"name":"libxml2 as a component of Red Hat Enterprise Linux 6","product_id":"red_hat_enterprise_linux_6:libxml2"},"product_reference":"libxml2","relates_to_product_reference":"red_hat_enterprise_linux_6"},{"category":"default_component_of","full_product_name":{"name":"libxml2-devel as a component of Red Hat Enterprise Linux 6","product_id":"red_hat_enterprise_linux_6:libxml2-devel"},"product_reference":"libxml2-devel","relates_to_product_reference":"red_hat_enterprise_linux_6"},{"category":"default_component_of","full_product_name":{"name":"libxml2-python as a component of Red Hat Enterprise Linux 6","product_id":"red_hat_enterprise_linux_6:libxml2-python"},"product_reference":"libxml2-python","relates_to_product_reference":"red_hat_enterprise_linux_6"},{"category":"default_component_of","full_product_name":{"name":"libxml2-static as a component of Red Hat Enterprise Linux 6","product_id":"red_hat_enterprise_linux_6:libxml2-static"},"product_reference":"libxml2-static","relates_to_product_reference":"red_hat_enterprise_linux_6"},{"category":"default_component_of","full_product_name":{"name":"libxml2.src as a component of Red Hat Enterprise Linux 6","product_id":"red_hat_enterprise_linux_6:libxml2.src"},"product_reference":"libxml2.src","relates_to_product_reference":"red_hat_enterprise_linux_6"},{"category":"default_component_of","full_product_name":{"name":"libxml2 as a component of Red Hat Enterprise Linux 7","product_id":"red_hat_enterprise_linux_7:libxml2"},"product_reference":"libxml2","relates_to_product_reference":"red_hat_enterprise_linux_7"},{"category":"default_component_of","full_product_name":{"name":"libxml2-devel as a component of Red Hat Enterprise Linux 7","product_id":"red_hat_enterprise_linux_7:libxml2-devel"},"product_reference":"libxml2-devel","relates_to_product_reference":"red_hat_enterprise_linux_7"},{"category":"default_component_of","full_product_name":{"name":"libxml2-python as a component of Red Hat Enterprise Linux 7","product_id":"red_hat_enterprise_linux_7:libxml2-python"},"product_reference":"libxml2-python","relates_to_product_reference":"red_hat_enterprise_linux_7"},{"category":"default_component_of","full_product_name":{"name":"libxml2-static as a component of Red Hat Enterprise Linux 7","product_id":"red_hat_enterprise_linux_7:libxml2-static"},"product_reference":"libxml2-static","relates_to_product_reference":"red_hat_enterprise_linux_7"},{"category":"default_component_of","full_product_name":{"name":"libxml2.src as a component of Red Hat Enterprise Linux 7","product_id":"red_hat_enterprise_linux_7:libxml2.src"},"product_reference":"libxml2.src","relates_to_product_reference":"red_hat_enterprise_linux_7"},{"category":"default_component_of","full_product_name":{"name":"libxml2 as a component of Red Hat Enterprise Linux 8","product_id":"red_hat_enterprise_linux_8:libxml2"},"product_reference":"libxml2","relates_to_product_reference":"red_hat_enterprise_linux_8"},{"category":"default_component_of","full_product_name":{"name":"libxml2-devel as a component of Red Hat Enterprise Linux 8","product_id":"red_hat_enterprise_linux_8:libxml2-devel"},"product_reference":"libxml2-devel","relates_to_product_reference":"red_hat_enterprise_linux_8"},{"category":"default_component_of","full_product_name":{"name":"libxml2.src as a component of Red Hat Enterprise Linux 8","product_id":"red_hat_enterprise_linux_8:libxml2.src"},"product_reference":"libxml2.src","relates_to_product_reference":"red_hat_enterprise_linux_8"},{"category":"default_component_of","full_product_name":{"name":"podman-catatonit (container-tools:rhel8) as a component of Red Hat Enterprise Linux 8","product_id":"red_hat_enterprise_linux_8:podman-catatonit::container-tools:rhel8"},"product_reference":"podman-catatonit::container-tools:rhel8","relates_to_product_reference":"red_hat_enterprise_linux_8"},{"category":"default_component_of","full_product_name":{"name":"podman-docker (container-tools:rhel8) as a component of Red Hat Enterprise Linux 8","product_id":"red_hat_enterprise_linux_8:podman-docker::container-tools:rhel8"},"product_reference":"podman-docker::container-tools:rhel8","relates_to_product_reference":"red_hat_enterprise_linux_8"},{"category":"default_component_of","full_product_name":{"name":"podman-gvproxy (container-tools:rhel8) as a component of Red Hat Enterprise Linux 8","product_id":"red_hat_enterprise_linux_8:podman-gvproxy::container-tools:rhel8"},"product_reference":"podman-gvproxy::container-tools:rhel8","relates_to_product_reference":"red_hat_enterprise_linux_8"},{"category":"default_component_of","full_product_name":{"name":"podman-manpages (container-tools:rhel8) as a component of Red Hat Enterprise Linux 8","product_id":"red_hat_enterprise_linux_8:podman-manpages::container-tools:rhel8"},"product_reference":"podman-manpages::container-tools:rhel8","relates_to_product_reference":"red_hat_enterprise_linux_8"},{"category":"default_component_of","full_product_name":{"name":"podman-plugins (container-tools:rhel8) as a component of Red Hat Enterprise Linux 8","product_id":"red_hat_enterprise_linux_8:podman-plugins::container-tools:rhel8"},"product_reference":"podman-plugins::container-tools:rhel8","relates_to_product_reference":"red_hat_enterprise_linux_8"},{"category":"default_component_of","full_product_name":{"name":"podman-remote (container-tools:rhel8) as a component of Red Hat Enterprise Linux 8","product_id":"red_hat_enterprise_linux_8:podman-remote::container-tools:rhel8"},"product_reference":"podman-remote::container-tools:rhel8","relates_to_product_reference":"red_hat_enterprise_linux_8"},{"category":"default_component_of","full_product_name":{"name":"podman-tests (container-tools:rhel8) as a component of Red Hat Enterprise Linux 8","product_id":"red_hat_enterprise_linux_8:podman-tests::container-tools:rhel8"},"product_reference":"podman-tests::container-tools:rhel8","relates_to_product_reference":"red_hat_enterprise_linux_8"},{"category":"default_component_of","full_product_name":{"name":"podman.src (container-tools:rhel8) as a component of Red Hat Enterprise Linux 8","product_id":"red_hat_enterprise_linux_8:podman.src::container-tools:rhel8"},"product_reference":"podman.src::container-tools:rhel8","relates_to_product_reference":"red_hat_enterprise_linux_8"},{"category":"default_component_of","full_product_name":{"name":"podman (container-tools:rhel8) as a component of Red Hat Enterprise Linux 8","product_id":"red_hat_enterprise_linux_8:podman::container-tools:rhel8"},"product_reference":"podman::container-tools:rhel8","relates_to_product_reference":"red_hat_enterprise_linux_8"},{"category":"default_component_of","full_product_name":{"name":"python3-libxml2 as a component of Red Hat Enterprise Linux 8","product_id":"red_hat_enterprise_linux_8:python3-libxml2"},"product_reference":"python3-libxml2","relates_to_product_reference":"red_hat_enterprise_linux_8"},{"category":"default_component_of","full_product_name":{"name":"libxml2 as a component of Red Hat Enterprise Linux 9","product_id":"red_hat_enterprise_linux_9:libxml2"},"product_reference":"libxml2","relates_to_product_reference":"red_hat_enterprise_linux_9"},{"category":"default_component_of","full_product_name":{"name":"libxml2-devel as a component of Red Hat Enterprise Linux 9","product_id":"red_hat_enterprise_linux_9:libxml2-devel"},"product_reference":"libxml2-devel","relates_to_product_reference":"red_hat_enterprise_linux_9"},{"category":"default_component_of","full_product_name":{"name":"libxml2.src as a component of Red Hat Enterprise Linux 9","product_id":"red_hat_enterprise_linux_9:libxml2.src"},"product_reference":"libxml2.src","relates_to_product_reference":"red_hat_enterprise_linux_9"},{"category":"default_component_of","full_product_name":{"name":"podman as a component of Red Hat Enterprise Linux 9","product_id":"red_hat_enterprise_linux_9:podman"},"product_reference":"podman","relates_to_product_reference":"red_hat_enterprise_linux_9"},{"category":"default_component_of","full_product_name":{"name":"podman-catatonit as a component of Red Hat Enterprise Linux 9","product_id":"red_hat_enterprise_linux_9:podman-catatonit"},"product_reference":"podman-catatonit","relates_to_product_reference":"red_hat_enterprise_linux_9"},{"category":"default_component_of","full_product_name":{"name":"podman-docker as a component of Red Hat Enterprise Linux 9","product_id":"red_hat_enterprise_linux_9:podman-docker"},"product_reference":"podman-docker","relates_to_product_reference":"red_hat_enterprise_linux_9"},{"category":"default_component_of","full_product_name":{"name":"podman-gvproxy as a component of Red Hat Enterprise Linux 9","product_id":"red_hat_enterprise_linux_9:podman-gvproxy"},"product_reference":"podman-gvproxy","relates_to_product_reference":"red_hat_enterprise_linux_9"},{"category":"default_component_of","full_product_name":{"name":"podman-plugins as a component of Red Hat Enterprise Linux 9","product_id":"red_hat_enterprise_linux_9:podman-plugins"},"product_reference":"podman-plugins","relates_to_product_reference":"red_hat_enterprise_linux_9"},{"category":"default_component_of","full_product_name":{"name":"podman-remote as a component of Red Hat Enterprise Linux 9","product_id":"red_hat_enterprise_linux_9:podman-remote"},"product_reference":"podman-remote","relates_to_product_reference":"red_hat_enterprise_linux_9"},{"category":"default_component_of","full_product_name":{"name":"podman-tests as a component of Red Hat Enterprise Linux 9","product_id":"red_hat_enterprise_linux_9:podman-tests"},"product_reference":"podman-tests","relates_to_product_reference":"red_hat_enterprise_linux_9"},{"category":"default_component_of","full_product_name":{"name":"podman.src as a component of Red Hat Enterprise Linux 9","product_id":"red_hat_enterprise_linux_9:podman.src"},"product_reference":"podman.src","relates_to_product_reference":"red_hat_enterprise_linux_9"},{"category":"default_component_of","full_product_name":{"name":"python3-libxml2 as a component of Red Hat Enterprise Linux 9","product_id":"red_hat_enterprise_linux_9:python3-libxml2"},"product_reference":"python3-libxml2","relates_to_product_reference":"red_hat_enterprise_linux_9"},{"category":"default_component_of","full_product_name":{"name":"libxml2.src as a component of Red Hat Hardened Images","product_id":"red_hat_hardened_images:libxml2.src"},"product_reference":"libxml2.src","relates_to_product_reference":"red_hat_hardened_images"},{"category":"default_component_of","full_product_name":{"name":"swift-lang.src as a component of Red Hat Hardened Images","product_id":"red_hat_hardened_images:swift-lang.src"},"product_reference":"swift-lang.src","relates_to_product_reference":"red_hat_hardened_images"},{"category":"default_component_of","full_product_name":{"name":"openshift/ose-rhel-coreos-8 as a component of Red Hat OpenShift Container Platform 4","product_id":"red_hat_openshift_container_platform_4:openshift/ose-rhel-coreos-8"},"product_reference":"openshift/ose-rhel-coreos-8","relates_to_product_reference":"red_hat_openshift_container_platform_4"},{"category":"default_component_of","full_product_name":{"name":"openshift/ose-rhel-coreos-9 as a component of Red Hat OpenShift Container Platform 4","product_id":"red_hat_openshift_container_platform_4:openshift/ose-rhel-coreos-9"},"product_reference":"openshift/ose-rhel-coreos-9","relates_to_product_reference":"red_hat_openshift_container_platform_4"},{"category":"default_component_of","full_product_name":{"name":"podman as a component of Red Hat OpenShift Container Platform 4","product_id":"red_hat_openshift_container_platform_4:podman"},"product_reference":"podman","relates_to_product_reference":"red_hat_openshift_container_platform_4"},{"category":"default_component_of","full_product_name":{"name":"podman-catatonit as a component of Red Hat OpenShift Container Platform 4","product_id":"red_hat_openshift_container_platform_4:podman-catatonit"},"product_reference":"podman-catatonit","relates_to_product_reference":"red_hat_openshift_container_platform_4"},{"category":"default_component_of","full_product_name":{"name":"podman-docker as a component of Red Hat OpenShift Container Platform 4","product_id":"red_hat_openshift_container_platform_4:podman-docker"},"product_reference":"podman-docker","relates_to_product_reference":"red_hat_openshift_container_platform_4"},{"category":"default_component_of","full_product_name":{"name":"podman-gvproxy as a component of Red Hat OpenShift Container Platform 4","product_id":"red_hat_openshift_container_platform_4:podman-gvproxy"},"product_reference":"podman-gvproxy","relates_to_product_reference":"red_hat_openshift_container_platform_4"},{"category":"default_component_of","full_product_name":{"name":"podman-manpages as a component of Red Hat OpenShift Container Platform 4","product_id":"red_hat_openshift_container_platform_4:podman-manpages"},"product_reference":"podman-manpages","relates_to_product_reference":"red_hat_openshift_container_platform_4"},{"category":"default_component_of","full_product_name":{"name":"podman-plugins as a component of Red Hat OpenShift Container Platform 4","product_id":"red_hat_openshift_container_platform_4:podman-plugins"},"product_reference":"podman-plugins","relates_to_product_reference":"red_hat_openshift_container_platform_4"},{"category":"default_component_of","full_product_name":{"name":"podman-remote as a component of Red Hat OpenShift Container Platform 4","product_id":"red_hat_openshift_container_platform_4:podman-remote"},"product_reference":"podman-remote","relates_to_product_reference":"red_hat_openshift_container_platform_4"},{"category":"default_component_of","full_product_name":{"name":"podman-tests as a component of Red Hat OpenShift Container Platform 4","product_id":"red_hat_openshift_container_platform_4:podman-tests"},"product_reference":"podman-tests","relates_to_product_reference":"red_hat_openshift_container_platform_4"},{"category":"default_component_of","full_product_name":{"name":"podman.src as a component of Red Hat OpenShift Container Platform 4","product_id":"red_hat_openshift_container_platform_4:podman.src"},"product_reference":"podman.src","relates_to_product_reference":"red_hat_openshift_container_platform_4"}]},"vulnerabilities":[{"cve":"CVE-2026-86140","cwe":{"id":"CWE-120","name":"Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"},"discovery_date":"2026-09-05T04:41:05.796692+00:00","flags":[{"label":"vulnerable_code_not_present","product_ids":["red_hat_enterprise_linux_10:podman","red_hat_enterprise_linux_10:podman-docker","red_hat_enterprise_linux_10:podman-remote","red_hat_enterprise_linux_10:podman-tests","red_hat_enterprise_linux_10:podman.src","red_hat_enterprise_linux_8:podman-catatonit::container-tools:rhel8","red_hat_enterprise_linux_8:podman-docker::container-tools:rhel8","red_hat_enterprise_linux_8:podman-gvproxy::container-tools:rhel8","red_hat_enterprise_linux_8:podman-manpages::container-tools:rhel8","red_hat_enterprise_linux_8:podman-plugins::container-tools:rhel8","red_hat_enterprise_linux_8:podman-remote::container-tools:rhel8","red_hat_enterprise_linux_8:podman-tests::container-tools:rhel8","red_hat_enterprise_linux_8:podman.src::container-tools:rhel8","red_hat_enterprise_linux_8:podman::container-tools:rhel8","red_hat_enterprise_linux_9:podman","red_hat_enterprise_linux_9:podman-catatonit","red_hat_enterprise_linux_9:podman-docker","red_hat_enterprise_linux_9:podman-gvproxy","red_hat_enterprise_linux_9:podman-plugins","red_hat_enterprise_linux_9:podman-remote","red_hat_enterprise_linux_9:podman-tests","red_hat_enterprise_linux_9:podman.src","red_hat_hardened_images:swift-lang.src","red_hat_openshift_container_platform_4:podman","red_hat_openshift_container_platform_4:podman-catatonit","red_hat_openshift_container_platform_4:podman-docker","red_hat_openshift_container_platform_4:podman-gvproxy","red_hat_openshift_container_platform_4:podman-manpages","red_hat_openshift_container_platform_4:podman-plugins","red_hat_openshift_container_platform_4:podman-remote","red_hat_openshift_container_platform_4:podman-tests","red_hat_openshift_container_platform_4:podman.src"]}],"ids":[{"system_name":"Red Hat Bugzilla ID","text":"2528989"}],"notes":[{"category":"description","text":"A flaw was found in libxml2. A local attacker could exploit a stack-based buffer overflow in the `xmlSnprintfElements` function to achieve arbitrary code execution. This vulnerability in a fundamental system library could lead to significant system compromise if successfully exploited.","title":"Vulnerability description"},{"category":"summary","text":"libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements","title":"Vulnerability summary"},{"category":"other","text":"This Important flaw in libxml2 allows a local attacker to achieve arbitrary code execution due to a stack-based buffer overflow. While requiring local access, the vulnerability's presence in a fundamental system library could lead to significant system compromise if exploited.","title":"Statement"},{"category":"general","text":"The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.","title":"CVSS score applicability"}],"product_status":{"known_affected":["red_hat_enterprise_linux_10:libxml2","red_hat_enterprise_linux_10:libxml2-devel","red_hat_enterprise_linux_10:libxml2-static","red_hat_enterprise_linux_10:libxml2.src","red_hat_enterprise_linux_10:python3-libxml2","red_hat_enterprise_linux_6:libxml2","red_hat_enterprise_linux_6:libxml2-devel","red_hat_enterprise_linux_6:libxml2-python","red_hat_enterprise_linux_6:libxml2-static","red_hat_enterprise_linux_6:libxml2.src","red_hat_enterprise_linux_7:libxml2","red_hat_enterprise_linux_7:libxml2-devel","red_hat_enterprise_linux_7:libxml2-python","red_hat_enterprise_linux_7:libxml2-static","red_hat_enterprise_linux_7:libxml2.src","red_hat_enterprise_linux_8:libxml2","red_hat_enterprise_linux_8:libxml2-devel","red_hat_enterprise_linux_8:libxml2.src","red_hat_enterprise_linux_8:python3-libxml2","red_hat_enterprise_linux_9:libxml2","red_hat_enterprise_linux_9:libxml2-devel","red_hat_enterprise_linux_9:libxml2.src","red_hat_enterprise_linux_9:python3-libxml2","red_hat_hardened_images:libxml2.src","red_hat_openshift_container_platform_4:openshift/ose-rhel-coreos-8","red_hat_openshift_container_platform_4:openshift/ose-rhel-coreos-9"],"known_not_affected":["red_hat_enterprise_linux_10:podman","red_hat_enterprise_linux_10:podman-docker","red_hat_enterprise_linux_10:podman-remote","red_hat_enterprise_linux_10:podman-tests","red_hat_enterprise_linux_10:podman.src","red_hat_enterprise_linux_8:podman-catatonit::container-tools:rhel8","red_hat_enterprise_linux_8:podman-docker::container-tools:rhel8","red_hat_enterprise_linux_8:podman-gvproxy::container-tools:rhel8","red_hat_enterprise_linux_8:podman-manpages::container-tools:rhel8","red_hat_enterprise_linux_8:podman-plugins::container-tools:rhel8","red_hat_enterprise_linux_8:podman-remote::container-tools:rhel8","red_hat_enterprise_linux_8:podman-tests::container-tools:rhel8","red_hat_enterprise_linux_8:podman.src::container-tools:rhel8","red_hat_enterprise_linux_8:podman::container-tools:rhel8","red_hat_enterprise_linux_9:podman","red_hat_enterprise_linux_9:podman-catatonit","red_hat_enterprise_linux_9:podman-docker","red_hat_enterprise_linux_9:podman-gvproxy","red_hat_enterprise_linux_9:podman-plugins","red_hat_enterprise_linux_9:podman-remote","red_hat_enterprise_linux_9:podman-tests","red_hat_enterprise_linux_9:podman.src","red_hat_hardened_images:swift-lang.src","red_hat_openshift_container_platform_4:podman","red_hat_openshift_container_platform_4:podman-catatonit","red_hat_openshift_container_platform_4:podman-docker","red_hat_openshift_container_platform_4:podman-gvproxy","red_hat_openshift_container_platform_4:podman-manpages","red_hat_openshift_container_platform_4:podman-plugins","red_hat_openshift_container_platform_4:podman-remote","red_hat_openshift_container_platform_4:podman-tests","red_hat_openshift_container_platform_4:podman.src"]},"references":[{"category":"self","summary":"Canonical URL","url":"https://access.redhat.com/security/cve/CVE-2026-86140"},{"category":"external","summary":"RHBZ#2528989","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528989"},{"category":"external","summary":"https://www.cve.org/CVERecord?id=CVE-2026-86140","url":"https://www.cve.org/CVERecord?id=CVE-2026-86140"},{"category":"external","summary":"https://nvd.nist.gov/vuln/detail/CVE-2026-86140","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86140"},{"category":"external","summary":"https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340","url":"https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340"},{"category":"external","summary":"https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4","url":"https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"}],"release_date":"2026-09-05T04:26:13.860000+00:00","remediations":[{"category":"workaround","details":"To mitigate this, administrators should disable DTD processing and validation for untrusted documents within libxml2 parsers and restrict network access so only authorized users can submit XML data to the application. For robust defense-in-depth against buffer overflow exploitation, ensure the library and dependent applications are compiled with memory safety flags like stack canaries (-fstack-protector-strong) and bounds checking (_FORTIFY_SOURCE=2), while verifying that standard OS-level protections such as ASLR and Data Execution Prevention (NX/XD Bit) are active on the host system.","product_ids":["red_hat_enterprise_linux_10:libxml2","red_hat_enterprise_linux_10:libxml2-devel","red_hat_enterprise_linux_10:libxml2-static","red_hat_enterprise_linux_10:libxml2.src","red_hat_enterprise_linux_10:python3-libxml2","red_hat_enterprise_linux_6:libxml2","red_hat_enterprise_linux_6:libxml2-devel","red_hat_enterprise_linux_6:libxml2-python","red_hat_enterprise_linux_6:libxml2-static","red_hat_enterprise_linux_6:libxml2.src","red_hat_enterprise_linux_7:libxml2","red_hat_enterprise_linux_7:libxml2-devel","red_hat_enterprise_linux_7:libxml2-python","red_hat_enterprise_linux_7:libxml2-static","red_hat_enterprise_linux_7:libxml2.src","red_hat_enterprise_linux_8:libxml2","red_hat_enterprise_linux_8:libxml2-devel","red_hat_enterprise_linux_8:libxml2.src","red_hat_enterprise_linux_8:python3-libxml2","red_hat_enterprise_linux_9:libxml2","red_hat_enterprise_linux_9:libxml2-devel","red_hat_enterprise_linux_9:libxml2.src","red_hat_enterprise_linux_9:python3-libxml2","red_hat_hardened_images:libxml2.src","red_hat_openshift_container_platform_4:openshift/ose-rhel-coreos-8","red_hat_openshift_container_platform_4:openshift/ose-rhel-coreos-9"]},{"category":"no_fix_planned","details":"Out of support scope","product_ids":["red_hat_enterprise_linux_6:libxml2","red_hat_enterprise_linux_6:libxml2-devel","red_hat_enterprise_linux_6:libxml2-python","red_hat_enterprise_linux_6:libxml2-static","red_hat_enterprise_linux_6:libxml2.src"]},{"category":"none_available","details":"Affected","product_ids":["red_hat_enterprise_linux_10:libxml2","red_hat_enterprise_linux_10:libxml2-devel","red_hat_enterprise_linux_10:libxml2-static","red_hat_enterprise_linux_10:libxml2.src","red_hat_enterprise_linux_10:python3-libxml2","red_hat_enterprise_linux_7:libxml2","red_hat_enterprise_linux_7:libxml2-devel","red_hat_enterprise_linux_7:libxml2-python","red_hat_enterprise_linux_7:libxml2-static","red_hat_enterprise_linux_7:libxml2.src","red_hat_enterprise_linux_8:libxml2","red_hat_enterprise_linux_8:libxml2-devel","red_hat_enterprise_linux_8:libxml2.src","red_hat_enterprise_linux_8:python3-libxml2","red_hat_enterprise_linux_9:libxml2","red_hat_enterprise_linux_9:libxml2-devel","red_hat_enterprise_linux_9:libxml2.src","red_hat_enterprise_linux_9:python3-libxml2","red_hat_hardened_images:libxml2.src","red_hat_openshift_container_platform_4:openshift/ose-rhel-coreos-8","red_hat_openshift_container_platform_4:openshift/ose-rhel-coreos-9"]}],"scores":[{"cvss_v3":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["red_hat_enterprise_linux_10:libxml2","red_hat_enterprise_linux_10:libxml2-devel","red_hat_enterprise_linux_10:libxml2-static","red_hat_enterprise_linux_10:libxml2.src","red_hat_enterprise_linux_10:podman","red_hat_enterprise_linux_10:podman-docker","red_hat_enterprise_linux_10:podman-remote","red_hat_enterprise_linux_10:podman-tests","red_hat_enterprise_linux_10:podman.src","red_hat_enterprise_linux_10:python3-libxml2","red_hat_enterprise_linux_6:libxml2","red_hat_enterprise_linux_6:libxml2-devel","red_hat_enterprise_linux_6:libxml2-python","red_hat_enterprise_linux_6:libxml2-static","red_hat_enterprise_linux_6:libxml2.src","red_hat_enterprise_linux_7:libxml2","red_hat_enterprise_linux_7:libxml2-devel","red_hat_enterprise_linux_7:libxml2-python","red_hat_enterprise_linux_7:libxml2-static","red_hat_enterprise_linux_7:libxml2.src","red_hat_enterprise_linux_8:libxml2","red_hat_enterprise_linux_8:libxml2-devel","red_hat_enterprise_linux_8:libxml2.src","red_hat_enterprise_linux_8:podman-catatonit::container-tools:rhel8","red_hat_enterprise_linux_8:podman-docker::container-tools:rhel8","red_hat_enterprise_linux_8:podman-gvproxy::container-tools:rhel8","red_hat_enterprise_linux_8:podman-manpages::container-tools:rhel8","red_hat_enterprise_linux_8:podman-plugins::container-tools:rhel8","red_hat_enterprise_linux_8:podman-remote::container-tools:rhel8","red_hat_enterprise_linux_8:podman-tests::container-tools:rhel8","red_hat_enterprise_linux_8:podman.src::container-tools:rhel8","red_hat_enterprise_linux_8:podman::container-tools:rhel8","red_hat_enterprise_linux_8:python3-libxml2","red_hat_enterprise_linux_9:libxml2","red_hat_enterprise_linux_9:libxml2-devel","red_hat_enterprise_linux_9:libxml2.src","red_hat_enterprise_linux_9:podman","red_hat_enterprise_linux_9:podman-catatonit","red_hat_enterprise_linux_9:podman-docker","red_hat_enterprise_linux_9:podman-gvproxy","red_hat_enterprise_linux_9:podman-plugins","red_hat_enterprise_linux_9:podman-remote","red_hat_enterprise_linux_9:podman-tests","red_hat_enterprise_linux_9:podman.src","red_hat_enterprise_linux_9:python3-libxml2","red_hat_hardened_images:libxml2.src","red_hat_hardened_images:swift-lang.src","red_hat_openshift_container_platform_4:openshift/ose-rhel-coreos-8","red_hat_openshift_container_platform_4:openshift/ose-rhel-coreos-9","red_hat_openshift_container_platform_4:podman","red_hat_openshift_container_platform_4:podman-catatonit","red_hat_openshift_container_platform_4:podman-docker","red_hat_openshift_container_platform_4:podman-gvproxy","red_hat_openshift_container_platform_4:podman-manpages","red_hat_openshift_container_platform_4:podman-plugins","red_hat_openshift_container_platform_4:podman-remote","red_hat_openshift_container_platform_4:podman-tests","red_hat_openshift_container_platform_4:podman.src"]}],"threats":[{"category":"impact","details":"Important","product_ids":["red_hat_enterprise_linux_10:libxml2","red_hat_enterprise_linux_10:libxml2-devel","red_hat_enterprise_linux_10:libxml2-static","red_hat_enterprise_linux_10:libxml2.src","red_hat_enterprise_linux_10:podman","red_hat_enterprise_linux_10:podman-docker","red_hat_enterprise_linux_10:podman-remote","red_hat_enterprise_linux_10:podman-tests","red_hat_enterprise_linux_10:podman.src","red_hat_enterprise_linux_10:python3-libxml2","red_hat_enterprise_linux_6:libxml2","red_hat_enterprise_linux_6:libxml2-devel","red_hat_enterprise_linux_6:libxml2-python","red_hat_enterprise_linux_6:libxml2-static","red_hat_enterprise_linux_6:libxml2.src","red_hat_enterprise_linux_7:libxml2","red_hat_enterprise_linux_7:libxml2-devel","red_hat_enterprise_linux_7:libxml2-python","red_hat_enterprise_linux_7:libxml2-static","red_hat_enterprise_linux_7:libxml2.src","red_hat_enterprise_linux_8:libxml2","red_hat_enterprise_linux_8:libxml2-devel","red_hat_enterprise_linux_8:libxml2.src","red_hat_enterprise_linux_8:podman-catatonit::container-tools:rhel8","red_hat_enterprise_linux_8:podman-docker::container-tools:rhel8","red_hat_enterprise_linux_8:podman-gvproxy::container-tools:rhel8","red_hat_enterprise_linux_8:podman-manpages::container-tools:rhel8","red_hat_enterprise_linux_8:podman-plugins::container-tools:rhel8","red_hat_enterprise_linux_8:podman-remote::container-tools:rhel8","red_hat_enterprise_linux_8:podman-tests::container-tools:rhel8","red_hat_enterprise_linux_8:podman.src::container-tools:rhel8","red_hat_enterprise_linux_8:podman::container-tools:rhel8","red_hat_enterprise_linux_8:python3-libxml2","red_hat_enterprise_linux_9:libxml2","red_hat_enterprise_linux_9:libxml2-devel","red_hat_enterprise_linux_9:libxml2.src","red_hat_enterprise_linux_9:podman","red_hat_enterprise_linux_9:podman-catatonit","red_hat_enterprise_linux_9:podman-docker","red_hat_enterprise_linux_9:podman-gvproxy","red_hat_enterprise_linux_9:podman-plugins","red_hat_enterprise_linux_9:podman-remote","red_hat_enterprise_linux_9:podman-tests","red_hat_enterprise_linux_9:podman.src","red_hat_enterprise_linux_9:python3-libxml2","red_hat_hardened_images:libxml2.src","red_hat_hardened_images:swift-lang.src","red_hat_openshift_container_platform_4:openshift/ose-rhel-coreos-8","red_hat_openshift_container_platform_4:openshift/ose-rhel-coreos-9","red_hat_openshift_container_platform_4:podman","red_hat_openshift_container_platform_4:podman-catatonit","red_hat_openshift_container_platform_4:podman-docker","red_hat_openshift_container_platform_4:podman-gvproxy","red_hat_openshift_container_platform_4:podman-manpages","red_hat_openshift_container_platform_4:podman-plugins","red_hat_openshift_container_platform_4:podman-remote","red_hat_openshift_container_platform_4:podman-tests","red_hat_openshift_container_platform_4:podman.src"]}],"title":"libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements"}]}