PT-2026-51315 · Libxml2 · Libxml2

Geoffrey Humphreys · Published 2026-06-22 · Updated 2026-06-22 · CVE-2026-6653

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions libxml2 versions 2.9.11 through 2.11.0

Description A Use After Free issue exists in the xmlParseInternalSubset() function of libxml2. This occurs due to improper entity resolution handling, which allows a remote attacker to cause a denial-of-service by providing maliciously crafted XML input. Use After Free is a memory corruption flaw where a program continues to use a pointer after it has been freed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

XXE

Use After Free

Weakness Enumeration

CWE-611

CWE-416

Related Identifiers

CVE-2026-6653

Affected Products

Libxml2

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-6653 · Security Note
• https://twitter.com/infoflowcloud/status/2069092074951938307 · Twitter Post
• https://twitter.com/CVEnew/status/2069090888350073256 · Twitter Post
• https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260 · Note
• https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058 · Note
• https://twitter.com/VulmonFeeds/status/2069082267540922408 · Twitter Post