cve-2026-11979

{
  "cvss": 1.8,
  "datePublished": "2026-06-29T14:16:40.593",
  "dateUpdated": "2026-10-25T21:10:00.770",
  "description": "libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking.\nBy supplying an overly long input line, an attacker can overflow internal buffers (command, arg, and argv) during input parsing. This results in memory corruption within the stack frame.\nSuccessful exploitation may cause a crash or potentially allow arbitrary code execution in the context of the xmlcatalog process.\n\nThis issue has been fixed in the commit c2e233fc.\n\nNOTE:\nThe maintainers of this project did not agree that this issue is a vulnerability and considered it a bug.",
  "id": "CVE-2026-11979",
  "raw": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "modules": [
              "xmlcatalog"
            ],
            "product": "libxml2",
            "repo": "https://gitlab.gnome.org/GNOME/libxml2/",
            "vendor": "xmlsoft",
            "versions": [
              {
                "lessThanOrEqual": "2.15.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "cvd@cert.pl"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "8749CC9B-7846-4BD8-892D-31E4B18D771C",
                "versionEndIncluding": "2.15.3",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [
      {
        "sourceIdentifier": "cvd@cert.pl",
        "tags": [
          "disputed"
        ]
      }
    ],
    "descriptions": [
      {
        "lang": "en",
        "value": "libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking.\nBy supplying an overly long input line, an attacker can overflow internal buffers (command, arg, and argv) during input parsing. This results in memory corruption within the stack frame.\nSuccessful exploitation may cause a crash or potentially allow arbitrary code execution in the context of the xmlcatalog process.\n\nThis issue has been fixed in the commit c2e233fc.\n\nNOTE:\nThe maintainers of this project did not agree that this issue is a vulnerability and considered it a bug."
      },
      {
        "lang": "es",
        "value": "libxml2 es vulnerable a múltiples desbordamientos de búfer basados en pila en la utilidad xmlcatalog cuando se ejecuta en modo --shell. La función usershell() procesa la entrada del usuario utilizando búferes de pila de tamaño fijo sin una comprobación de límites adecuada.\nAl proporcionar una línea de entrada excesivamente larga, un atacante puede desbordar búferes internos (command, arg y argv) durante el análisis de la entrada. Esto resulta en corrupción de memoria dentro del marco de pila.\nLa explotación exitosa puede causar un fallo o potencialmente permitir la ejecución de código arbitrario en el contexto del proceso xmlcatalog.\n\nEste problema ha sido corregido en el commit c2e233fc.\n\nNOTA:\nLos mantenedores de este proyecto no estuvieron de acuerdo en que este problema sea una vulnerabilidad y lo consideraron un error."
      }
    ],
    "id": "CVE-2026-11979",
    "lastModified": "2026-10-25T21:10:00.770",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 1.8,
            "baseSeverity": "LOW",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "NOT_DEFINED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "cvd@cert.pl",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-11979",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-06-29T13:59:12.311421Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-06-29T14:16:40.593",
    "references": [
      {
        "source": "cvd@cert.pl",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://cert.pl/en/posts/2026/06/CVE-2026-11979"
      },
      {
        "source": "cvd@cert.pl",
        "tags": [
          "Patch"
        ],
        "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e"
      }
    ],
    "sourceIdentifier": "cvd@cert.pl",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-121"
          }
        ],
        "source": "cvd@cert.pl",
        "type": "Secondary"
      }
    ]
  },
  "severity": "LOW",
  "source": "nvd",
  "title": "libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode"
}