VORANT. Threat Intelligence Sign in Get the full feed

libxml2 xmlcatalog Shell Mode Buffer Overflow

low vulnerability

CERT Polska coordinated disclosure of stack-based buffer overflows in libxml2's xmlcatalog --shell mode that could crash or execute code.

CERT Polska disclosed CVE-2026-11979, a set of stack-based buffer overflow vulnerabilities in xmlsoft's libxml2 library, specifically within the xmlcatalog utility's --shell interactive mode. The usershell() function parses user-supplied input using fixed-size stack buffers (command, arg, and argv) without proper bounds checking, allowing an attacker who can supply an overly long input line to overflow these buffers and corrupt the stack frame.

Successful exploitation could result in a crash of the xmlcatalog process or, in more severe cases, arbitrary code execution in the context of that process. The issue has been patched via commit c2e233fc, though notably the libxml2 maintainers disputed the classification of this issue as a security vulnerability, treating it instead as a standard bug. The flaw was reported by Michal Majchrowicz and Marcin Wyczechowski of AFINE through CERT Polska's coordinated vulnerability disclosure process. Exploitation requires local interactive use of the xmlcatalog shell mode, limiting the practical attack surface compared to remotely exploitable parsing vulnerabilities in libxml2's core XML processing.

Mentioned in this report

Vulnerabilities CVE-2026-11979

Related reporting

Detection guidance

xmlcatalog Shell Mode Interactive Execution

ATT&CK T1203

Detects xmlcatalog utility spawned with --shell flag, enabling interactive command parsing vulnerable to buffer overflow exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: xmlcatalog Shell Mode Interactive Execution
description: Detects execution of xmlcatalog with --shell flag, which enables the
  interactive shell mode containing stack-based buffer overflow vulnerabilities in
  input parsing. This behaviour is rare in automated/legitimate usage and primarily
  appears in manual testing or targeted exploitation scenarios.
tags:
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: xmlcatalog.exe
    CommandLine|contains: --shell
  condition: selection
falsepositives:
- Manual testing or debugging of XML catalogs by developers
- Legitimate XML toolchain validation scripts
level: medium
id: f5f2673c-b35b-5105-a220-68165d33a5b4
status: experimental
author: Vorant

xmlcatalog Process Crash or Abnormal Termination

ATT&CK T1203

Detects xmlcatalog process terminating with exit code indicating stack corruption or crash, consistent with buffer overflow exploitation attempt. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: xmlcatalog Process Crash or Abnormal Termination
description: Detects xmlcatalog process exiting with non-zero exit codes (particularly
  those indicating access violation or stack corruption), which may indicate a buffer
  overflow exploitation attempt in shell mode. Exit codes 0xC0000374 (STATUS_HEAP_CORRUPTION)
  or 0xC0000005 (STATUS_ACCESS_VIOLATION) are high-signal indicators.
tags:
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: xmlcatalog.exe
    ExitCode:
    - 3221225477
    - 3221226356
    - 3221226505
  condition: selection
falsepositives:
- Malformed XML catalog files causing parser errors
- Out-of-memory conditions in resource-constrained environments
level: high
id: 728d5fa4-24a8-59ca-b38c-0844f39e3520
status: experimental
author: Vorant

xmlcatalog Spawned from Suspicious Parent Process

ATT&CK T1203

Detects xmlcatalog utility launched from non-standard parent process (script interpreter, web browser, or suspicious shell), indicating potential exploit delivery vehicle. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: xmlcatalog Spawned from Suspicious Parent Process
description: Detects xmlcatalog spawned from unusual parent processes such as script
  interpreters (python, perl, bash), browsers, or shells that are not typical legitimate
  XML tooling workflows. This pattern suggests exploitation via a delivery script
  or web-based attack vector rather than direct developer usage.
tags:
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: xmlcatalog.exe
    ParentImage|endswith:
    - \python.exe
    - \python3.exe
    - \perl.exe
    - \bash.exe
    - \sh.exe
    - \cmd.exe
    - \powershell.exe
    - \chrome.exe
    - \firefox.exe
    - \iexplore.exe
  filter_build_systems:
    ParentCommandLine|contains:
    - cmake
    - make
    - gradle
  condition: selection and not filter_build_systems
falsepositives:
- Build automation tools (Maven, CMake) invoking xmlcatalog for validation
- IT deployment scripts legitimately running XML parsing utilities
level: medium
id: 04e8ac98-9087-5b52-88f1-94b45ea5ea2b
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-11979

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free