A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 7.5 · xmlsoft, redhat, ibmNVD modified 2026-10-26 21:10
Affected (CPE criteria) 13
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_core_services:-:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:vios:*:*:*:*:*:*:*:*cpe:2.3:a:ibm:vios:4.1.2.0:*:*:*:*:*:*:*cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:*cpe:2.3:o:ibm:aix:7.3.4:*:*:*:*:*:*:*
References 5
- https://access.redhat.com/errata/RHSA-2026:11503 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-6732 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2461300 Issue Tracking, Third Party Advisory
- https://gitlab.gnome.org/GNOME/libxml2/-/issues/1097 Exploit, Issue Tracking, Third Party Advisory
- https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/411 Issue Tracking, Third Party Advisory