EUVD-2026-81679
GHSA-2j5r-8qjf-mq34
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Trigger occurs in-process during local catalog parsing (AV:L) requiring a user to load the malicious file (UI:R); crash yields availability-only impact (A:H, C/I:N), no privileges needed.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
3DescriptionCVE.org
A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a nextCatalog element lacks its mandatory catalog attribute, leading to the application crashing and causing a Denial of Service (DoS).
AnalysisAI
A NULL pointer dereference in libxml2's XML catalog parser allows a crash-induced denial of service when a catalog file contains a nextCatalog element missing its mandatory catalog attribute. Affected deployments are those in which an application linked against libxml2 parses an attacker-influenced catalog - Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and OpenShift Container Platform 4 carry vulnerable libxml2 packages per the supplied CPE data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a libxml2-linked application perform XML catalog parsing on attacker-influenced input, specifically a catalog containing a `nextCatalog` element that lacks its mandatory `catalog` attribute. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but low-priority availability issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream libxml2 fix - commit c6324894 (merge request 442, https://gitlab.gnome.org/GNOME/libxml2/-/commit/c6324894 and https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/442) - and track Red Hat's per-release errata via https://access.redhat.com/security/cve/CVE-2026-76781 and https://bugzilla.redhat.com/show_bug.cgi?id=2519776 to obtain the exact patched libxml2 package versions for RHEL 6/7/8/9/10, Hardened Images, and OpenShift 4; note that upstream fix availability is confirmed while a released patched distribution version is not independently verified in this dataset, so validate the vendor advisory before assuming coverage. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stack-based buffer overflow in libxml2's xmlBuildQName function allows remote unauthenticated attackers to crash affecte
xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS befor
The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer
Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X b
Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9
A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. Rated high severity (CVSS 7.5), this vulnerabil
The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denia
parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities. Rated high severity (CVSS 7.
The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial
Multiple use-after-free vulnerabilities in libxml2 2.9.0 and possibly other versions might allow context-dependent attac
The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS befo
The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 1
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today