libxml2 EUVD-2026-38232

The target application must link against GNOME libxml2 in the 2.9.11-2.11.0 range and must parse attacker-controlled XML with DTD/internal-subset processing enabled (the xmlParseInternalSubset code path is only reached when the document contains a DOCTYPE declaration with an inline '[...]' subset and entity resolution is permitted). No authentication, privilege, or user interaction is required (PR:N/UI:N), but CVSS AC:H indicates the use-after-free is not deterministic - successful triggering depends on heap state and parameter-entity expansion ordering, so repeated attempts or specific document structures may be necessary. Applications that have explicitly disabled DTD loading and entity substitution (e.g. XML_PARSE_NOENT/XML_PARSE_DTDLOAD off, or lxml resolve_entities=False) are not reachable through this path.

The signals are mixed and worth reading carefully. The supplied CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N) confirms remote, unauthenticated reachability but flags high attack complexity, which is consistent with use-after-free conditions that depend on heap layout and entity-expansion ordering. E:P confirms publicly available exploit code exists, but there is no CISA KEV listing and no EPSS score was provided, so widespread automated exploitation is not evidenced. Importantly, the supplied CVSS 4.0 metrics claim VC:H/VI:L/VA:L while the textual description states only denial-of-service - this is a meaningful conflict: either the vendor scored conservatively for a UAF that could in principle leak memory, or the score is overstated relative to demonstrated impact; defenders should treat this as DoS-confirmed and information-disclosure-possible until vendor analysis clarifies. Practical risk is highest for servers that parse attacker-supplied XML (SOAP, SAML, RSS, OOXML/ODF, configuration import).

An attacker submits a specially crafted XML document - for example via a public SOAP endpoint, SAML assertion, RSS feed, OOXML upload, or configuration import - whose DOCTYPE internal subset contains entity declarations engineered to trigger the dangling-pointer condition in xmlParseInternalSubset. When the libxml2-backed parser processes the internal subset, the freed entity object is dereferenced, crashing the worker process and denying service; given that proof-of-concept code exists per CVSS E:P, weaponization against any internet-exposed XML parser using a vulnerable libxml2 build is straightforward, though the AC:H rating implies the crash may not be deterministic on every run.