- CVE-2025-27113: NULL pointer dereference in xmlPatMatch(). An explicit child:: axis step compiled to XML_OP_CHILD, an op that accepts a document node and does not advance the current node, so a pattern such as "/child::name" matched against a document node reached the unguarded node->parent dereference in the XML_OP_ROOT case. Compile child:: to XML_OP_ELEM like the implicit axis (upstream 503f788e), which also makes the DOM matcher agree with the streaming matcher. Upstream fixed only the compiler side; the XML_OP_ROOT dereference is left unguarded here as it is upstream, and no in-tree caller can reach it - CVE-2025-32415: heap out-of-bounds read during XML Schema identity-constraint validation. xmlSchemaIDCFillNodeTables() snapshotted the IDC node-table length before its target loop, but the loop shrinks the table when it moves a duplicate key-sequence to bind->dupls. With the stale length the loop rescans slots past the live end of the table and, once the table is empty, evaluates bind->nodeTable[-1], reading one element before the allocation and driving the node count negative. Use the live bind->nbNodes for both the loop guard and the loop terminator (upstream 384cc7c1, v2.13.8; master twin 487ee1d8, v2.14.2) - CVE-2025-6021: fix integer overflow in xmlBuildQName() (tree.c). The prefix and local-name lengths were held in int and summed in int arithmetic, so a long enough QName made lenn + lenp + 2 wrap negative, which both defeated the buffer-size test -- handing back a caller's 50-byte stack buffer -- and undersized the xmlMallocAtomic() allocation, letting the following memcpy()s and the NUL store write out of bounds. The lengths are now size_t, a negative len is rejected, and the sum is bounded against SIZE_MAX before it is formed. Backport of upstream 17d950ae33c23f87692aa179bacedb6743f3188a. - CVE-2026-11979: multiple stack-based buffer overflows in the xmlcatalog utility's --shell mode. usershell() copied the command token, the argument tail and the argument vector of a line of user input into the fixed-size command[100], arg[400] and argv[20] stack buffers with no bounds check, so a single over-long line corrupted the stack frame. All three copy loops are now bounded and reject over-long input with a diagnostic (upstream cd48d441, first released in v2.15.4). Only the xmlcatalog command-line utility is affected; no library entry point reaches usershell() - xmlcatalog: reject --add/--del invocations that run off the end of argv (upstream b1fea45b). Not a CVE and not part of CVE-2026-11979; carried alongside it because upstream shipped both in the same release and both touch xmlcatalog.c. Without it, "xmlcatalog --add a" reads argv[4] past the end of the argument vector and passes whatever follows - in practice a process environment string - to xmlCatalogAdd()