---
title: "xmlsoft vulnerabilities: CVEs, CISA KEV and security advisories"
url: https://radicalnotion.ai/vendor/xmlsoft
type: vendor
description: "xmlsoft has 144 published CVEs, 0 in CISA KEV and 56 with public exploits."
updated: 2026-09-05
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# xmlsoft vulnerabilities

- **Published CVEs:** 144
- **In CISA KEV:** 0
- **With a public exploit:** 56
- **With a patch:** 144
- **Average CVSS:** 6.9
- **CVEs in the last two years:** 27
- **First CVE:** 2004-03-04
- **Latest CVE:** 2026-09-05

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 18 |
| High | 60 |
| Medium | 60 |
| Low | 6 |
| Unscored | 0 |

## Most affected products

| Product | CVEs |
| --- | --- |
| [libxml2](https://radicalnotion.ai/vendor/xmlsoft/libxml2) | 116 |
| [libxslt](https://radicalnotion.ai/vendor/xmlsoft/libxslt) | 25 |
| [libxml](https://radicalnotion.ai/vendor/xmlsoft/libxml) | 8 |
| [xmllint](https://radicalnotion.ai/vendor/xmlsoft/xmllint) | 2 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-119](https://radicalnotion.ai/cwe/cwe-119) | Improper Restriction of Operations within the Bounds of a Memory Buffer | 31 |
| [CWE-416](https://radicalnotion.ai/cwe/cwe-416) | Use After Free | 17 |
| [CWE-125](https://radicalnotion.ai/cwe/cwe-125) | Out-of-bounds Read | 9 |
| [CWE-399](https://radicalnotion.ai/cwe/cwe-399) | Resource Management Errors | 8 |
| [CWE-476](https://radicalnotion.ai/cwe/cwe-476) | NULL Pointer Dereference | 6 |
| [CWE-122](https://radicalnotion.ai/cwe/cwe-122) | Heap-based Buffer Overflow | 5 |
| [CWE-190](https://radicalnotion.ai/cwe/cwe-190) | Integer Overflow or Wraparound | 5 |
| [CWE-674](https://radicalnotion.ai/cwe/cwe-674) | Uncontrolled Recursion | 5 |

## Assigning CNAs

| CNA | CVEs |
| --- | --- |
| [mitre](https://radicalnotion.ai/cna/mitre) | 69 |
| [redhat](https://radicalnotion.ai/cna/redhat) | 39 |
| [apple](https://radicalnotion.ai/cna/apple) | 14 |
| [Chrome](https://radicalnotion.ai/cna/chrome) | 13 |
| [debian](https://radicalnotion.ai/cna/debian) | 2 |
| [microfocus](https://radicalnotion.ai/cna/microfocus) | 2 |
| [canonical](https://radicalnotion.ai/cna/canonical) | 2 |
| [CERT-PL](https://radicalnotion.ai/cna/cert-pl) | 1 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2019 | 6 |
| 2020 | 3 |
| 2021 | 6 |
| 2022 | 6 |
| 2023 | 4 |
| 2024 | 3 |
| 2025 | 13 |
| 2026 | 14 |

## Latest CVEs

| CVE | Title | Severity | CVSS | EPSS | CISA KEV | Published |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-86144 | - | high | 7.8 | 0.2% | No | 2026-09-05 |
| CVE-2026-86143 | - | high | 7.3 | 0.2% | No | 2026-09-05 |
| CVE-2026-86142 | - | high | 7.8 | 0.2% | No | 2026-09-05 |
| CVE-2026-86141 | - | low | 3.3 | 0.2% | No | 2026-09-05 |
| CVE-2026-86140 | - | high | 8.0 | 0.2% | No | 2026-09-05 |
| CVE-2026-86139 | - | high | 7.8 | 0.2% | No | 2026-09-05 |
| CVE-2026-86138 | - | high | 7.8 | 0.1% | No | 2026-09-05 |
| CVE-2026-86137 | - | medium | 6.1 | 0.2% | No | 2026-09-05 |
| CVE-2026-11979 | Stack-Based Buffer Overflow in libxml2 | low | 1.8 | 0.1% | No | 2026-06-29 |
| CVE-2026-6653 | libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling | high | 7.0 | 0.4% | No | 2026-06-22 |
| CVE-2026-6732 | Libxml2: libxml2: denial of service via crafted xsd-validated document | high | 7.5 | 0.6% | No | 2026-04-23 |
| CVE-2026-0992 | Libxml2: libxml2: denial of service via crafted xml catalogs | low | 2.9 | 0.5% | No | 2026-01-15 |

## Frequently asked questions

### How many CVEs does xmlsoft have?

xmlsoft has 144 published CVE records since 2004, including 27 in the last two years.

### How many xmlsoft CVEs are in CISA KEV?

None of xmlsoft's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Which xmlsoft products have the most CVEs?

The xmlsoft products with the most published CVEs are libxml2, libxslt, libxml, xmllint.

### What are the most common weakness types in xmlsoft CVEs?

xmlsoft's CVEs most often map to these CWE weakness types: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-416 (Use After Free), CWE-125 (Out-of-bounds Read), CWE-399 (Resource Management Errors).

### Are there public exploits for xmlsoft vulnerabilities?

Yes — 56 of xmlsoft's CVEs have a known public exploit.

### How many critical xmlsoft vulnerabilities are there?

xmlsoft has 18 critical and 60 high-severity CVEs.

### What is the average severity of xmlsoft CVEs?

The average CVSS base score across xmlsoft's scored CVEs is 6.9.

## Related vendors

- [PHPJabbers](https://radicalnotion.ai/vendor/php-jabbers) (146 CVEs)
- [SICK](https://radicalnotion.ai/vendor/sick) (146 CVEs)
- [Zabbix](https://radicalnotion.ai/vendor/zabbix) (145 CVEs)
- [graalvm](https://radicalnotion.ai/vendor/graalvm) (145 CVEs)
- [Veritas](https://radicalnotion.ai/vendor/veritas) (144 CVEs)
- [Fuji Electric](https://radicalnotion.ai/vendor/fuji-electric) (144 CVEs)
- [parseplatform](https://radicalnotion.ai/vendor/parseplatform) (143 CVEs)
- [StellarWP](https://radicalnotion.ai/vendor/stellarwp) (143 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/xmlsoft). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.