libxml2 xmlcatalog Shell Mode Buffer Overflow

CERT Polska coordinated disclosure of stack-based buffer overflows in libxml2's xmlcatalog --shell mode that could crash or execute code.

CERT Polska disclosed CVE-2026-11979, a set of stack-based buffer overflow vulnerabilities in xmlsoft's libxml2 library, specifically within the xmlcatalog utility's --shell interactive mode. The usershell() function parses user-supplied input using fixed-size stack buffers (command, arg, and argv) without proper bounds checking, allowing an attacker who can supply an overly long input line to overflow these buffers and corrupt the stack frame.

Successful exploitation could result in a crash of the xmlcatalog process or, in more severe cases, arbitrary code execution in the context of that process. The issue has been patched via commit c2e233fc, though notably the libxml2 maintainers disputed the classification of this issue as a security vulnerability, treating it instead as a standard bug. The flaw was reported by Michal Majchrowicz and Marcin Wyczechowski of AFINE through CERT Polska's coordinated vulnerability disclosure process. Exploitation requires local interactive use of the xmlcatalog shell mode, limiting the practical attack surface compared to remotely exploitable parsing vulnerabilities in libxml2's core XML processing.

Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-11979