libxml2 xmlcatalog Shell Mode Buffer Overflow
CERT Polska coordinated disclosure of stack-based buffer overflows in libxml2's xmlcatalog --shell mode that could crash or execute code.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska disclosed CVE-2026-11979, a set of stack-based buffer overflow vulnerabilities in xmlsoft's libxml2 library, specifically within the xmlcatalog utility's --shell interactive mode. The usershell() function parses user-supplied input using fixed-size stack buffers (command, arg, and argv) without proper bounds checking, allowing an attacker who can supply an overly long input line to overflow these buffers and corrupt the stack frame.
Successful exploitation could result in a crash of the xmlcatalog process or, in more severe cases, arbitrary code execution in the context of that process. The issue has been patched via commit c2e233fc, though notably the libxml2 maintainers disputed the classification of this issue as a security vulnerability, treating it instead as a standard bug. The flaw was reported by Michal Majchrowicz and Marcin Wyczechowski of AFINE through CERT Polska's coordinated vulnerability disclosure process. Exploitation requires local interactive use of the xmlcatalog shell mode, limiting the practical attack surface compared to remotely exploitable parsing vulnerabilities in libxml2's core XML processing.
Mentioned in this report
Detection guidance
xmlcatalog Shell Mode Interactive Execution
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects xmlcatalog utility spawned with --shell flag, enabling interactive command parsing vulnerable to buffer overflow exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: xmlcatalog Shell Mode Interactive Execution
description: Detects execution of xmlcatalog with --shell flag, which enables the
interactive shell mode containing stack-based buffer overflow vulnerabilities in
input parsing. This behaviour is rare in automated/legitimate usage and primarily
appears in manual testing or targeted exploitation scenarios.
tags:
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: xmlcatalog.exe
CommandLine|contains: --shell
condition: selection
falsepositives:
- Manual testing or debugging of XML catalogs by developers
- Legitimate XML toolchain validation scripts
level: medium
id: f5f2673c-b35b-5105-a220-68165d33a5b4
status: experimental
author: Vorant
xmlcatalog Spawned from Suspicious Parent Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects xmlcatalog utility launched from non-standard parent process (script interpreter, web browser, or suspicious shell), indicating potential exploit delivery vehicle. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: xmlcatalog Spawned from Suspicious Parent Process
description: Detects xmlcatalog spawned from unusual parent processes such as script
interpreters (python, perl, bash), browsers, or shells that are not typical legitimate
XML tooling workflows. This pattern suggests exploitation via a delivery script
or web-based attack vector rather than direct developer usage.
tags:
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: xmlcatalog.exe
ParentImage|endswith:
- \python.exe
- \python3.exe
- \perl.exe
- \bash.exe
- \sh.exe
- \cmd.exe
- \powershell.exe
- \chrome.exe
- \firefox.exe
- \iexplore.exe
filter_build_systems:
ParentCommandLine|contains:
- cmake
- make
- gradle
condition: selection and not filter_build_systems
falsepositives:
- Build automation tools (Maven, CMake) invoking xmlcatalog for validation
- IT deployment scripts legitimately running XML parsing utilities
level: medium
id: 04e8ac98-9087-5b52-88f1-94b45ea5ea2b
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-11979
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs