[AutoPR- Security] Patch libxml2 for CVE-2026-86144, CVE-2026-86143, CVE-2026-86142, CVE-2026-86140, CVE-2026-86138, CVE-2026-86137 [HIGH]

[Azure Linux Security Servicing Account (azurelinux-security)]

Auto Patch libxml2 for CVE-2026-86144, CVE-2026-86143, CVE-2026-86142, CVE-2026-86140, CVE-2026-86138, CVE-2026-86137.

Autosec pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1198332&view=results

CVE-2026-86144 : Single Patch Backporter Pipeline Run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1198342&view=results
CVE-2026-86143 : Single Patch Backporter Pipeline Run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1198341&view=results
CVE-2026-86137 : Single Patch Backporter Pipeline Run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1198340&view=results

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

What does the PR accomplish, why was it needed?

• Auto Patch libxml2 for CVE-2026-86144 (MEDIUM), CVE-2026-86143 (MEDIUM), CVE-2026-86142 (MEDIUM), CVE-2026-86140 (HIGH), CVE-2026-86138 (MEDIUM), CVE-2026-86137 (LOW).

Change Log

• CVE-2026-86144
• CVE-2026-86143
• CVE-2026-86142
• CVE-2026-86140
• CVE-2026-86138
• CVE-2026-86137

Does this affect the toolchain?

YES/NO

Associated issues

• N/A

Links to CVEs

• https://nvd.nist.gov/vuln/detail/CVE-2026-86144
• https://nvd.nist.gov/vuln/detail/CVE-2026-86143
• https://nvd.nist.gov/vuln/detail/CVE-2026-86142
• https://nvd.nist.gov/vuln/detail/CVE-2026-86140
• https://nvd.nist.gov/vuln/detail/CVE-2026-86138
• https://nvd.nist.gov/vuln/detail/CVE-2026-86137

Test Methodology

• Pipeline build id: Buddy Build URL

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[v-swapsahu]

Patch Analysis:

CVE-2026-86137 : xmlregexp Out-of-Bounds Read
Backported: Yes

The backport correctly implements the upstream fix by adding bounds checking to the NXT macro and tracking string length in the parser context.

Files Modified

• xmlregexp.c — Out-of-bounds read protection in regex parser

CVE-2026-86138 : (xmlDictAddQString Integer Overflow)

Patch matches with upstream patch. all hunks succeeded without issues.

Files Modified

• dict.c — Dictionary string allocation with overflow protection

CVE-2026-86140: (xmlSnprintfElements Buffer Overflow)

Patch matches with upstream patch. all hunks succeeded without issues.

Files Modified

• valid.c — XML DTD validation with bounds checking in string formatting

CVE-2026-86142: (xmlXPtrEvalXPtrPart Integer Overflow)

Backported: Yes
-Upstream 595d7d8 touched only xpointer.c (7 insertions) — because in the newer tree xmlXPathPErrMemory was already accessible.
-v2.11.5 backport needs the extra xpath.c + xpath.h plumbing to reach that same helper.

Files Modified

• xpointer.c — XPointer evaluation with overflow detection (the actual fix)
• xpath.c — Makes xmlXPathPErrMemory non-static so it can be reused
• include/private/xpath.h — Declares xmlXPathPErrMemory for internal use

CVE-2026-86143: (xmlOutputBufferWrite Integer Overflow)
Backported: Yes

The backport correctly implements upstream's overflow detection by checking buffer sizes against INT_MAX before passing them to write callbacks. The fix prevents integer overflow issues by validating that size_t buffer sizes fit within the int parameter range, ensuring safe operation even with very large buffers.

Files Modified

• xmlIO.c — XML I/O buffer output with integer overflow protection

CVE-2026-86144: (XInclude parseFlags Propagation)
Backported: Yes

The backport correctly implements upstream's fix by propagating doc->parseFlags into XInclude sub-processing, ensuring uniform security policy enforcement. The fix has been independently validated with a standalone POC demonstrating that the vulnerability is eliminated.

Files Modified

xinclude.c — Propagates parse flags into XInclude text/subtree loads; adds XML_IO_NETWORK_ATTEMPT to the load-error filter

Why test cases were not added

-Missing APIs — The test needs per-context error handlers (xmlCtxtSetErrorHandler, xmlTextReaderSetStructuredErrorHandler), which don't exist until 2.12; they fail to link on 2.11.5.

-Different error strings — The .err files expect upstream's failed to load "URL" wording, but 2.11.5 emits Attempt to load network entity URL, so the byte-comparison never matches.

-Stability risk — Adapting the test to 2.11.5's global error handler regressed the whole %check suite (schemas/relaxng/xmlid cascaded to 90+ failures).

Verification

Patch Application:

Build and Test Results:

POC Summary — CVE-2026-86144

Goal: Prove the fix makes XInclude honor XML_PARSE_NONET, blocking attacker-controlled network fetches.

Vulnerability reproduced on unpatched lib

xmlXIncludeProcess dropped the flag → real HTTP request → secret exfiltrated into output.

Fix verified on patched lib

doc->parseFlags propagated → fetch blocked, error returned, zero server hits.

Pipelines - Run PR-18738+libxml2+unknown has been re-triggered and it has passed.