CVE-2026-74860

CVE-2026-74860 is a double-free vulnerability in libxml2 when it is built with its Python bindings enabled, located in the SAX attributeDecl callback handler where a string is freed twice. A remote attacker triggers the flaw by supplying a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values, causing the affected process to crash reproducibly. The practical impact is denial of service: any Python application that parses untrusted XML with libxml2's SAX bindings can be crashed by attacker-controlled input. Affected environments are those running libxml2 with the Python bindings (e.g., distro-shipped libxml2 Python bindings) to process XML from untrusted sources; the advisory, assigned by Red Hat, does not specify affected version numbers. There is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at roughly 0.3%, so no exploitation is currently known.

What to do: Update libxml2 (and the associated Python bindings package, e.g., your distribution's libxml2-python/python3-libxml2) as soon as a fixed version is published in your vendor's security advisories; no fixed version number is available yet. As an interim mitigation, avoid using libxml2's Python SAX bindings to parse untrusted XML, and disable or restrict DTD processing (refuse documents with an internal or external DTD subset) for any input path that must remain active. Audit your estate for installs of the Python bindings and identify applications that feed untrusted XML into them, and monitor Red Hat and upstream libxml2 advisories for the fix.