Vulnerability Details CVE-2026-86141
xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 1.8%
CVSS Severity
CVSS v3 Score 2.9