USN-8787-1: libxml2 vulnerabilities
Ubuntu patched libxml2 flaws that could crash the library, enable code execution, or cause denial of service.
Ubuntu security notice USN-8787-1 covers two libxml2 vulnerabilities. CVE-2026-86140 involves incorrect handling of certain XML elements that could crash libxml2 or allow arbitrary code execution. CVE-2026-74860 affects XML document handling through Python bindings and could let a remote attacker crash applications, causing a denial of service. The notice does not say either flaw is being exploited.
- CVE-2026-86140 may crash libxml2 or allow arbitrary code execution.
- CVE-2026-74860 can crash applications using the Python bindings.
- Fixes are published in Ubuntu notice USN-8787-1.
- The notice does not report active exploitation.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-74860 | Double-free DoS in libxml2 Python bindings via crafted DTD attribute declarations | 8.5 | <1% | ||
| CVE-2026-86140 | Stack Buffer Overflow in libxml2 (xmlSnprintfElements) Fixed in 2.15.4 | 7.8 | <1% |
From the original article
It was discovered that libxml2 incorrectly handled certain XML elements under certain circumstances. An attacker could possibly use this issue to cause libxml2 to crash or execute arbitrary code. (CVE-2026-86140) It was discovered that libxml2 incorrectly handled certain XML documents when used with Python bindings.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.