CVE-2026-74860

Awaiting Analysis Awaiting Analysis - Queue

Double-Free in libxml2 with Python Bindings Enabled

Publication date: 2026-09-08

Last updated on: 2026-09-28

Assigner: redhat-SADP

Description

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-28

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-74860

Affected Vendors & Products

Vendor	Product	Version / Range
gnome	libxml2	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-763	The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.

Attack-Flow Graph

Executive Summary

This vulnerability is a double-free issue in libxml2 with Python bindings enabled. A remote attacker can exploit it by sending a specially crafted XML document containing a DTD with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, causing a string to be freed twice. The result is a denial of service (DoS) due to a reproducible crash in Python applications using libxml2 SAX bindings.

Detection Guidance

To detect this vulnerability, check if your system uses libxml2 with Python bindings enabled. Inspect installed packages for python3-libxml2 or libxml2-python. Review applications using libxml2 SAX bindings with attributeDecl handlers. Monitor for crashes when parsing XML with DTDs containing enumerated attribute values.

Impact Analysis

This flaw can lead to a denial of service (DoS) by crashing applications that use libxml2 with Python bindings and parse untrusted XML with DTDs containing enumerated attribute values. In some cases, it may also be exploitable for arbitrary code execution if heap grooming is successful.

Mitigation Strategies

Immediately update libxml2 to the latest patched version. Disable Python bindings for libxml2 if not required. Avoid parsing untrusted XML with DTDs in applications using libxml2 SAX bindings. Monitor vendor advisories for patches and apply them promptly.

Hi! I’m here to help you understand CVE-2026-74860. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70