Executive brief
A vulnerability has been identified in libxml2, a widely used software library for parsing XML data. An attacker could send a specially crafted XML file to an application using this library, causing the application to crash or behave unexpectedly. This could lead to a service outage (denial-of-service) for systems that process automated XML inputs, such as web services or document processing tools.
Technical details
A use-after-free (UAF) vulnerability exists in the xmlParseInternalSubset function within libxml2's parser.c. The flaw is triggered during the handling of internal subsets and entity resolution when processing maliciously crafted XML input. An attacker can exploit this by providing a specific XML structure that causes the parser to reference memory that has already been freed, leading to a crash (denial-of-service) or potentially unauthorized memory access. The issue was identified via fuzzing and is confirmed to affect versions 2.9.11 through 2.11.0, while being resolved in later development versions.
Affected products
- GNOME libxml2 2.9.11 to 2.11.0
Timeline
- 2026-02-08: disclosed: Bug reported to Ubuntu/Canonical with PoC
- 2026-06-22: advisory: CVE published and NVD record created