libxml2 CVE-2026-76781

Exploitation requires that a libxml2-linked application perform XML catalog parsing on attacker-influenced input, specifically a catalog containing a nextCatalog element that lacks its mandatory catalog attribute. The attack vector is local (AV:L) and requires user interaction (UI:R): a user or process must be induced to load/parse the malicious catalog file - it is not a remote unauthenticated network trigger. Limiting factors: impact is confined to a process crash (availability only, no code execution or data exposure), applications that never parse XML catalogs are unaffected, and any resilient/restartable service greatly reduces real impact. No authentication is required (PR:N) but the interaction and local-delivery requirements meaningfully constrain practical exploitation.

This is a genuine but low-priority availability issue. The CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) reflects an availability-only impact with no confidentiality or integrity consequences - a NULL pointer dereference crash, not memory corruption or code execution (CWE-476). The vector is telling: AV:L combined with UI:R means an attacker cannot reach this remotely on their own; a local user or process must parse an attacker-supplied malicious XML catalog. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no signal of active or automatable exploitation. The signals are internally consistent - a crash-only local DoS gated on user interaction is exactly what a 5.5 with A:H/UI:R should look like. The one nuance worth verifying with the vendor: the description opens with 'A local user or an attacker providing a specially crafted XML catalog,' which could be read as remote delivery of the malicious catalog file, but CVSS pins the actual trigger as local (AV:L) since the crash happens in-process during catalog parsing. Net: real bug, minimal real-world urgency - patch during routine maintenance.

An attacker crafts a malicious XML catalog file containing a nextCatalog element that omits its mandatory catalog attribute and gets it onto a system where a libxml2-linked application will parse it (e.g., via a catalog path the application reads). When libxml2 parses the catalog, it dereferences a NULL pointer and the application crashes, denying service. No public exploit code is identified at time of analysis, though the trigger is trivial and the fixing commit publicly documents the exact malformed input.