{
  "cveId": "CVE-2026-11979",
  "url": "https://patchblox.com/security/cve/CVE-2026-11979",
  "summary": "CVE-2026-11979 is fixed in 8 products on 1 platform, first by DEBIAN-CVE-2026-11979, released June 29, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "Stack-Based Buffer Overflow in libxml2",
  "description": "libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow internal buffers (command, arg, and argv) during input parsing. This results in memory corruption within the stack frame. Successful exploitation may cause a crash or potentially allow arbitrary code execution in the context of the xmlcatalog process.  This issue has been fixed in the commit c2e233fc.  NOTE: The maintainers of this project did not agree that this issue is a vulnerability and considered it a bug.",
  "published": "2026-06-29T13:21:42Z",
  "severity": "Low",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "cwe": "Stack-based Buffer Overflow",
  "epss": 0.00148,
  "epssPercentile": 0.04053,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-11979",
  "fixes": [
    {
      "platform": "linux",
      "product": "libxml2",
      "release": "Debian 14",
      "fixedVersion": "2.15.4\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2026-11979",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-11979",
      "released": "2026-06-29T14:16:40Z"
    },
    {
      "platform": "linux",
      "product": "libxml2",
      "release": "RHEL 10",
      "fixedVersion": "2.12.5-9.el10_0.9",
      "fix": "RHSA-2026:89759",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-89759",
      "released": "2026-08-28T00:38:13Z"
    },
    {
      "platform": "linux",
      "product": "libxml2",
      "release": "RHEL 8",
      "fixedVersion": "0:2.9.7-21.el8_10.7",
      "fix": "RHSA-2026:61248",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-61248",
      "released": "2026-09-13T12:46:35Z"
    },
    {
      "platform": "linux",
      "product": "libxml2",
      "release": "RHEL 9",
      "fixedVersion": "0:2.9.13-14.el9_8.4",
      "fix": "RHSA-2026:61247",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-61247",
      "released": "2026-09-13T12:47:53Z"
    },
    {
      "platform": "linux",
      "product": "libxml2",
      "release": "almalinux 10",
      "fixedVersion": "2.12.5-10.el10_2.3",
      "fix": "ALSA-2026:60394",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-60394",
      "released": "2026-08-26T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libxml2",
      "release": "almalinux 8",
      "fixedVersion": "2.9.7-21.el8_10.7",
      "fix": "ALSA-2026:61248",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-61248",
      "released": "2026-08-31T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libxml2",
      "release": "almalinux 9",
      "fixedVersion": "2.9.13-14.el9_8.4",
      "fix": "ALSA-2026:61247",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-61247",
      "released": "2026-08-31T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libxml2",
      "release": "amzn 2023",
      "fixedVersion": "2.10.4-1.amzn2023.0.20",
      "fix": "ALAS2023-2026-1992",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1992",
      "released": "2026-07-20T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libxml2",
      "release": "ol 10",
      "fixedVersion": "0:2.12.5-10.el10_2.3",
      "fix": "ELSA-2026-60394-0",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-60394-0",
      "released": "2026-08-27T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libxml2",
      "release": "ol 8",
      "fixedVersion": "0:2.9.7-21.el8_10.7",
      "fix": "ELSA-2026-61248-0",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-61248-0",
      "released": "2026-09-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libxml2",
      "release": "ol 9",
      "fixedVersion": "0:2.9.13-14.el9_8.4",
      "fix": "ELSA-2026-61247-0",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-61247-0",
      "released": "2026-09-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libxml2",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "2.13.8-160000.5.1",
      "fix": "OPENSUSE-SU-2026:21317-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21317-1",
      "released": "2026-07-13T07:51:58Z"
    },
    {
      "platform": "linux",
      "product": "libxml2",
      "release": "rocky 10",
      "fixedVersion": "0:2.12.5-10.el10_2.3",
      "fix": "RLSA-2026:60394",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2026-60394",
      "released": "2026-08-28T12:08:28Z"
    },
    {
      "platform": "linux",
      "product": "libxml2",
      "release": "rocky 8",
      "fixedVersion": "0:2.9.7-21.el8_10.7",
      "fix": "RLSA-2026:61248",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2026-61248",
      "released": "2026-08-31T12:01:18Z"
    },
    {
      "platform": "linux",
      "product": "libxml2",
      "release": "rocky 9",
      "fixedVersion": "0:2.9.13-14.el9_8.4",
      "fix": "RLSA-2026:61247",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2026-61247",
      "released": "2026-08-31T12:05:35Z"
    },
    {
      "platform": "linux",
      "product": "libxml2",
      "release": "sles 15.6",
      "fixedVersion": "2.10.3-150500.5.41.1",
      "fix": "SUSE-SU-2026:3096-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3096-1",
      "released": "2026-07-17T11:39:16Z"
    },
    {
      "platform": "linux",
      "product": "libxml2",
      "release": "sles 15.7",
      "fixedVersion": "2.12.10-150700.4.14.1",
      "fix": "SUSE-SU-2026:3097-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3097-1",
      "released": "2026-07-17T11:39:38Z"
    },
    {
      "platform": "linux",
      "product": "libxml2",
      "release": "sles 16.0",
      "fixedVersion": "2.13.8-160000.5.1",
      "fix": "SUSE-SU-2026:22636-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-22636-1",
      "released": "2026-07-13T07:52:15Z"
    },
    {
      "platform": "linux",
      "product": "libxml2-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "2.10.4-1.amzn2023.0.20",
      "fix": "ALAS2023-2026-1992",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1992",
      "released": "2026-07-20T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libxml2-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "2.10.4-1.amzn2023.0.20",
      "fix": "ALAS2023-2026-1992",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1992",
      "released": "2026-07-20T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libxml2-devel",
      "release": "RHEL 8",
      "fixedVersion": "0:2.9.7-21.el8_10.7",
      "fix": "RHSA-2026:61248",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-61248",
      "released": "2026-09-13T12:46:35Z"
    },
    {
      "platform": "linux",
      "product": "libxml2-devel",
      "release": "RHEL 9",
      "fixedVersion": "0:2.9.13-14.el9_8.4",
      "fix": "RHSA-2026:61247",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-61247",
      "released": "2026-09-13T12:47:53Z"
    },
    {
      "platform": "linux",
      "product": "libxml2-devel",
      "release": "almalinux 10",
      "fixedVersion": "2.12.5-10.el10_2.3",
      "fix": "ALSA-2026:60394",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-60394",
      "released": "2026-08-26T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libxml2-devel",
      "release": "almalinux 8",
      "fixedVersion": "2.9.7-21.el8_10.7",
      "fix": "ALSA-2026:61248",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-61248",
      "released": "2026-08-31T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libxml2-devel",
      "release": "almalinux 9",
      "fixedVersion": "2.9.13-14.el9_8.4",
      "fix": "ALSA-2026:61247",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-61247",
      "released": "2026-08-31T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libxml2-devel",
      "release": "amzn 2023",
      "fixedVersion": "2.10.4-1.amzn2023.0.20",
      "fix": "ALAS2023-2026-1992",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1992",
      "released": "2026-07-20T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libxml2-devel",
      "release": "ol 10",
      "fixedVersion": "0:2.12.5-10.el10_2.3",
      "fix": "ELSA-2026-60394-0",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-60394-0",
      "released": "2026-08-27T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libxml2-devel",
      "release": "ol 8",
      "fixedVersion": "0:2.9.7-21.el8_10.7",
      "fix": "ELSA-2026-61248-0",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-61248-0",
      "released": "2026-09-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libxml2-devel",
      "release": "ol 9",
      "fixedVersion": "0:2.9.13-14.el9_8.4",
      "fix": "ELSA-2026-61247-0",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-61247-0",
      "released": "2026-09-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libxml2-python",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "2.13.8-160000.5.1",
      "fix": "OPENSUSE-SU-2026:21317-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21317-1",
      "released": "2026-07-13T07:51:58Z"
    },
    {
      "platform": "linux",
      "product": "libxml2-python",
      "release": "sles 15.6",
      "fixedVersion": "2.10.3-150500.5.41.1",
      "fix": "SUSE-SU-2026:3096-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3096-1",
      "released": "2026-07-17T11:39:16Z"
    },
    {
      "platform": "linux",
      "product": "libxml2-python",
      "release": "sles 15.7",
      "fixedVersion": "2.12.10-150700.4.14.1",
      "fix": "SUSE-SU-2026:3097-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3097-1",
      "released": "2026-07-17T11:39:38Z"
    },
    {
      "platform": "linux",
      "product": "libxml2-python",
      "release": "sles 16.0",
      "fixedVersion": "2.13.8-160000.5.1",
      "fix": "SUSE-SU-2026:22636-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-22636-1",
      "released": "2026-07-13T07:52:15Z"
    },
    {
      "platform": "linux",
      "product": "libxml2-static",
      "release": "almalinux 10",
      "fixedVersion": "2.12.5-10.el10_2.3",
      "fix": "ALSA-2026:60394",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-60394",
      "released": "2026-08-26T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libxml2-static",
      "release": "amzn 2023",
      "fixedVersion": "2.10.4-1.amzn2023.0.20",
      "fix": "ALAS2023-2026-1992",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1992",
      "released": "2026-07-20T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libxml2-static",
      "release": "ol 10",
      "fixedVersion": "0:2.12.5-10.el10_2.3",
      "fix": "ELSA-2026-60394-0",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-60394-0",
      "released": "2026-08-27T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-libxml2",
      "release": "RHEL 8",
      "fixedVersion": "0:2.9.7-21.el8_10.7",
      "fix": "RHSA-2026:61248",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-61248",
      "released": "2026-09-13T12:46:35Z"
    },
    {
      "platform": "linux",
      "product": "python3-libxml2",
      "release": "RHEL 9",
      "fixedVersion": "0:2.9.13-14.el9_8.4",
      "fix": "RHSA-2026:61247",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-61247",
      "released": "2026-09-13T12:47:53Z"
    },
    {
      "platform": "linux",
      "product": "python3-libxml2",
      "release": "almalinux 10",
      "fixedVersion": "2.12.5-10.el10_2.3",
      "fix": "ALSA-2026:60394",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-60394",
      "released": "2026-08-26T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-libxml2",
      "release": "almalinux 8",
      "fixedVersion": "2.9.7-21.el8_10.7",
      "fix": "ALSA-2026:61248",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-61248",
      "released": "2026-08-31T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-libxml2",
      "release": "almalinux 9",
      "fixedVersion": "2.9.13-14.el9_8.4",
      "fix": "ALSA-2026:61247",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-61247",
      "released": "2026-08-31T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-libxml2",
      "release": "amzn 2023",
      "fixedVersion": "2.10.4-1.amzn2023.0.20",
      "fix": "ALAS2023-2026-1992",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1992",
      "released": "2026-07-20T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-libxml2",
      "release": "ol 10",
      "fixedVersion": "0:2.12.5-10.el10_2.3",
      "fix": "ELSA-2026-60394-0",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-60394-0",
      "released": "2026-08-27T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-libxml2",
      "release": "ol 8",
      "fixedVersion": "0:2.9.7-21.el8_10.7",
      "fix": "ELSA-2026-61248-0",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-61248-0",
      "released": "2026-09-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-libxml2",
      "release": "ol 9",
      "fixedVersion": "0:2.9.13-14.el9_8.4",
      "fix": "ELSA-2026-61247-0",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-61247-0",
      "released": "2026-09-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-libxml2-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "2.10.4-1.amzn2023.0.20",
      "fix": "ALAS2023-2026-1992",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1992",
      "released": "2026-07-20T09:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}