CVE-2026-86140 describes a stack-based buffer overflow vulnerability in libxml2 versions prior to 2.15.4. The flaw exists in the xmlSnprintfElements function within valid.c, where improper use of strcat can lead to a stack-based buffer overflow. libxml2 is a widely used XML parsing library, making this vulnerability potentially high impact across many applications and systems that depend on it. The issue has been patched in libxml2 version 2.15.4. A fix is available via the GNOME GitHub repository, with the relevant commit and version comparison accessible publicly. Users and maintainers are advised to upgrade to version 2.15.4 or later to mitigate the risk. The vulnerability is rated as high criticality given the nature of stack-based buffer overflows, which can potentially lead to code execution or denial of service.
