In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.

• azl3 libxml2 2.11.5-10 on Azure Linux 3.0

See the Microsoft Security Update Guide for the update that applies to your product.

1. Sep 6, 2026 at 4:36 AM UTC
   Published by Microsoft Security Response Center

   The publication date reported by the vendor.

2. Sep 8, 2026 at 1:58 AM UTC
   Updated by Microsoft Security Response Center

   The vendor changed the advisory after it was first published.

3. Sep 8, 2026 at 7:05 AM UTC
   Added to SecurityAlert

   We collected the advisory from the official source.

4. Sep 11, 2026 at 2:10 PM UTC
   Confirmed at the source

   Our collector saw this advisory during a later source check.