Junglewise Threat Intelligence

CVE-2026-6732: GNOME libxml2 type confusion in xmlParseReference

CVE-2026-6732 · Severity: medium · CVSS 6.5 · Published 2026-04-23

Technologies: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 6, Red Hat OpenShift Container Platform 4, Red Hat Enterprise Linux 9, IBM Aix, Red Hat Enterprise Linux 10. Vendors: Red Hat, IBM, Gnome.

Executive brief

A vulnerability has been identified in libxml2, a widely used library for processing XML data. When the library processes a specially crafted document using XML Schema validation, it can experience a 'type confusion' error that causes the application to crash. This can be used by attackers to cause a denial of service, potentially disrupting business operations or services that rely on XML processing.

Technical details

A type confusion vulnerability exists in libxml2's parser.c within the xmlParseReference function. The root cause is that the parser incorrectly passes the parser context (ctxt) instead of the user data pointer (ctxt->userData) to SAX characters and cdataBlock callbacks during the expansion of cached entity trees. When streaming XSD validation is active (e.g., via xmlTextReaderSchemaValidate), ctxt->userData is replaced with a schema-specific structure; passing the wrong pointer causes the application to dereference invalid memory or call incorrect function pointers, leading to a SIGSEGV. This can be triggered by any XML document containing an internal entity reference when XSD validation is enabled, regardless of the schema content. A patch has been proposed to ensure the correct userData pointer is passed to the SAX callbacks.

Affected products

  • GNOME libxml2 All versions prior to the fix in parser.c
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat OpenShift Container Platform 4
  • IBM AIX 7.2.5, 7.3.2, 7.3.4

Timeline

  • 2026-04-23: disclosed: Vulnerability reported and CVE-2026-6732 assigned.
  • 2026-04-29: patched: Red Hat issued security advisory RHSA-2026:11503.

References

Related threats