USN-8787-1: libxml2 vulnerabilities

CVE-2026-74860 is a double-free vulnerability in libxml2 when it is built with its Python bindings enabled, located in the SAX attributeDecl callback handler where a string is freed twice. A remote attacker triggers the flaw by supplying a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values, causing the affected process to crash reproducibly. The practical impact is denial of service: any Python application that parses untrusted XML with libxml2's SAX bindings can be crashed by attacker-controlled input. Affected environments are those running libxml2 with the Python bindings (e.g., distro-shipped libxml2 Python bindings) to process XML from untrusted sources; the advisory, assigned by Red Hat, does not specify affected version numbers. There is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at roughly 0.3%, so no exploitation is currently known.

Do: Update libxml2 (and the associated Python bindings package, e.g., your distribution's libxml2-python/python3-libxml2) as soon as a fixed version is published in your vendor's security advisories; no fixed version number is available yet. As an interim mitigation, avoid using libxml2's Python SAX bindings to parse untrusted XML, and disable or restrict DTD processing (refuse documents with an internal or external DTD subset) for any input path that must remain active. Audit your estate for installs of the Python bindings and identify applications that feed untrusted XML into them, and monitor Red Hat and upstream libxml2 advisories for the fix.

libxml2 versions before 2.15.4 contain a stack-based buffer overflow (CWE-121) in xmlSnprintfElements in valid.c, where unbounded strcat calls are used while building DTD validation error messages that enumerate an element's child elements. The flaw is triggered when a vulnerable application processes an XML document that fails DTD validation and whose error-description output exceeds the fixed-size stack buffer, such as a document with many or long child element names. Successful exploitation can corrupt the process stack, potentially crashing the application or enabling code execution with the privileges of the parsing process, consistent with the CVSS 3.1 score of 8 (high) reflecting high confidentiality and integrity impact and a local attack vector. Any application, service, or system linking a vulnerable libxml2 and performing DTD validation of untrusted XML is affected, which spans a large share of the software ecosystem given libxml2's role as a ubiquitous XML parsing library. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS currently estimates only a 0.1% probability of exploitation within 30 days.

Do: Upgrade libxml2 to 2.15.4 or later, or install updated libxml2 packages from your operating system or application vendor as they become available. Inventory applications and services linked against libxml2 and determine whether any of them perform DTD validation on untrusted XML input. As an interim mitigation, restrict or disable DTD validation of untrusted documents until patched.