RHSA-2026:64463
Vulnerability from csaf_redhat - Published: 2026-09-06 15:54 - Updated: 2026-09-09 15:38Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
libxml2:
* libxml2-16-2.15.4-0.1.hum1 (aarch64, x86_64)
* libxml2-2.15.4-0.1.hum1 (aarch64, x86_64)
* libxml2-devel-2.15.4-0.1.hum1 (aarch64, x86_64)
* libxml2-static-2.15.4-0.1.hum1 (aarch64, x86_64)
* python3-libxml2-2.15.4-0.1.hum1 (aarch64, x86_64)
* libxml2-2.15.4-0.1.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.
8.5 (High)
Affected products
Fixed
3 products
Threats
Impact
Important
A flaw was found in libxml2. This out-of-bounds read vulnerability, specifically within the `xmlFAParsePosCharGroup` function, could allow an attacker to cause a denial of service. By processing specially crafted XML input, the affected component may attempt to read data beyond its allocated memory buffer, leading to application instability or crashes.
CWE-125 - Out-of-bounds ReadAffected products
Fixed
3 products
Threats
Impact
Low
A flaw was found in libxml2, a software library for parsing XML documents. An integer overflow within the `xmlDictAddQString` function can lead to a heap-based buffer overflow. This vulnerability could allow a local attacker to execute arbitrary code on the system, potentially compromising its integrity and confidentiality.
6.9 (Medium)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:libxml2-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libxml2-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libxml2-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in libxml2. An integer overflow vulnerability exists in the `xmlURIEscapeStr` function within `uri.c`. This flaw could potentially lead to memory corruption, allowing an attacker to achieve information disclosure or arbitrary code execution.
6.9 (Medium)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:libxml2-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libxml2-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libxml2-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in libxml2. A local attacker could exploit a stack-based buffer overflow in the `xmlSnprintfElements` function to achieve arbitrary code execution. This vulnerability in a fundamental system library could lead to significant system compromise if successfully exploited.
7.4 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:libxml2-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libxml2-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libxml2-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A NULL pointer dereference in libxml2's xmlRegNewParserCtxt function allows a local attacker to cause a denial of service (DoS). The flaw occurs when strlen() is called on an unverified pointer following a failed xmlStrdup() memory allocation, resulting in a process crash.
CWE-252 - Unchecked Return ValueAffected products
Fixed
3 products
Threats
Impact
Low
A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer() expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure, data corruption, or a denial of service (DoS).
6.9 (Medium)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:libxml2-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libxml2-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libxml2-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
An integer overflow in the libxml2 xmlIO module occurs when data backlogs exceed maximum integer limits. This flaw passes negative length values to downstream write callbacks, creating an unsafe state that can lead to data corruption or compromise application confidentiality and integrity.
6.9 (Medium)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:libxml2-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libxml2-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libxml2-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw in libxml2's XInclude processing (xmlXIncludeProcess and xmlXIncludeProcessTree) fails to propagate parser flags like XML_PARSE_NONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery (SSRF), XML External Entity (XXE) injection, or Denial of Service (DoS) attacks.
5.6 (Medium)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:libxml2-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libxml2-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libxml2-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
References
62 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\nlibxml2:\n * libxml2-16-2.15.4-0.1.hum1 (aarch64, x86_64)\n * libxml2-2.15.4-0.1.hum1 (aarch64, x86_64)\n * libxml2-devel-2.15.4-0.1.hum1 (aarch64, x86_64)\n * libxml2-static-2.15.4-0.1.hum1 (aarch64, x86_64)\n * python3-libxml2-2.15.4-0.1.hum1 (aarch64, x86_64)\n * libxml2-2.15.4-0.1.hum1.src (src)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:64463",
"url": "https://access.redhat.com/errata/RHSA-2026:64463"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86137",
"url": "https://access.redhat.com/security/cve/CVE-2026-86137"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86143",
"url": "https://access.redhat.com/security/cve/CVE-2026-86143"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86141",
"url": "https://access.redhat.com/security/cve/CVE-2026-86141"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86140",
"url": "https://access.redhat.com/security/cve/CVE-2026-86140"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86138",
"url": "https://access.redhat.com/security/cve/CVE-2026-86138"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86144",
"url": "https://access.redhat.com/security/cve/CVE-2026-86144"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86139",
"url": "https://access.redhat.com/security/cve/CVE-2026-86139"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-86142",
"url": "https://access.redhat.com/security/cve/CVE-2026-86142"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-74860",
"url": "https://access.redhat.com/security/cve/CVE-2026-74860"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_64463.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-09-09T15:38:04+00:00",
"generator": {
"date": "2026-09-09T15:38:04+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:64463",
"initial_release_date": "2026-09-06T15:54:54+00:00",
"revision_history": [
{
"date": "2026-09-06T15:54:54+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-09T13:07:35+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-09T15:38:04+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "libxml2-main@aarch64",
"product": {
"name": "libxml2-main@aarch64",
"product_id": "libxml2-main@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libxml2-16@2.15.4-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "libxml2-main@x86_64",
"product": {
"name": "libxml2-main@x86_64",
"product_id": "libxml2-main@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libxml2-16@2.15.4-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "libxml2-main@src",
"product": {
"name": "libxml2-main@src",
"product_id": "libxml2-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libxml2@2.15.4-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libxml2-main@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libxml2-main@aarch64"
},
"product_reference": "libxml2-main@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxml2-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libxml2-main@src"
},
"product_reference": "libxml2-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libxml2-main@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libxml2-main@x86_64"
},
"product_reference": "libxml2-main@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-74860",
"cwe": {
"id": "CWE-763",
"name": "Release of Invalid Pointer or Reference"
},
"discovery_date": "2026-09-08T07:16:42.486000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2529697"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: double-free/UAF in libxml2 Python bindings",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-74860"
},
{
"category": "external",
"summary": "RHBZ#2529697",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529697"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-74860",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74860"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74860",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74860"
}
],
"release_date": "2026-03-08T09:20:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-06T15:54:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:64463"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libxml2: double-free/UAF in libxml2 Python bindings"
},
{
"cve": "CVE-2026-86137",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-05T04:30:57.361017+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528985"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libxml2. This out-of-bounds read vulnerability, specifically within the `xmlFAParsePosCharGroup` function, could allow an attacker to cause a denial of service. By processing specially crafted XML input, the affected component may attempt to read data beyond its allocated memory buffer, leading to application instability or crashes.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: libxml2: Denial of Service via out-of-bounds read in xmlFAParsePosCharGroup",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An out-of-bounds read in the libxml2 XML regular expression parser (xmlFAParsePosCharGroup) could allow a local attacker to cause a denial of service. The vulnerability carries a low impact rating due to its complex exploitation requirements and reliance on local access. This flaw is not present in any Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86137"
},
{
"category": "external",
"summary": "RHBZ#2528985",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528985"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86137"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86137",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86137"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/commit/76fe08d97de88bfaef2f7d5cd27f11954cc5bee2",
"url": "https://github.com/GNOME/libxml2/commit/76fe08d97de88bfaef2f7d5cd27f11954cc5bee2"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
"url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1099",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1099"
}
],
"release_date": "2026-09-05T04:19:30.745000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-06T15:54:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:64463"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 2.9,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "libxml2: libxml2: Denial of Service via out-of-bounds read in xmlFAParsePosCharGroup"
},
{
"cve": "CVE-2026-86138",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-09-05T04:31:00.379678+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528986"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libxml2, a software library for parsing XML documents. An integer overflow within the `xmlDictAddQString` function can lead to a heap-based buffer overflow. This vulnerability could allow a local attacker to execute arbitrary code on the system, potentially compromising its integrity and confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate severity heap-based buffer overflow in libxml2, specifically within the `xmlDictAddQString` function, could enable arbitrary code execution. While no user interaction or privileges are required, the high attack complexity and local attack vector reduce the overall risk in Red Hat environments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86138"
},
{
"category": "external",
"summary": "RHBZ#2528986",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528986"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86138",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86138"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86138",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86138"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4",
"url": "https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
"url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
}
],
"release_date": "2026-09-05T04:21:53.127000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-06T15:54:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:64463"
},
{
"category": "workaround",
"details": "Bound XML document and QName (prefix + local name) size before intern. Cap process and cgroup memory so a ~4 GiB dictionary pool cannot be built. Keep FORTIFY_SOURCE and heap hardening on Red Hat binaries.",
"product_ids": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow"
},
{
"cve": "CVE-2026-86139",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-09-05T04:41:11.735954+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528991"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libxml2. An integer overflow vulnerability exists in the `xmlURIEscapeStr` function within `uri.c`. This flaw could potentially lead to memory corruption, allowing an attacker to achieve information disclosure or arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: libxml2: Integer overflow in xmlURIEscapeStr may lead to arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An issue within the libxml2 xmlURIEscapeStr function could lead to arbitrary code execution. Despite the severe potential impact, the overall vulnerability is rated Moderate due to its high attack complexity and the strict prerequisite of local system access, which collectively constrain its exploitability in standard Red Hat environments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86139"
},
{
"category": "external",
"summary": "RHBZ#2528991",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528991"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86139",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86139"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86139",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86139"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/commit/8edbbdb09f24d26a2f900141fddc2b9d014f53b0",
"url": "https://github.com/GNOME/libxml2/commit/8edbbdb09f24d26a2f900141fddc2b9d014f53b0"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
"url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
}
],
"release_date": "2026-09-05T04:23:14.686000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-06T15:54:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:64463"
},
{
"category": "workaround",
"details": "To mitigate this developers must strictly cap URI and path lengths before passing data to libxml2 helpers to ensure multi-gigabyte strings cannot reach the vulnerable function. Furthermore, administrators should enforce strict process or cgroup memory limits to structurally prevent applications from allocating the excessively large buffers required to exceed maximum integer boundaries during string processing.",
"product_ids": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: libxml2: Integer overflow in xmlURIEscapeStr may lead to arbitrary code execution"
},
{
"cve": "CVE-2026-86140",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-09-05T04:41:05.796692+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528989"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libxml2. A local attacker could exploit a stack-based buffer overflow in the `xmlSnprintfElements` function to achieve arbitrary code execution. This vulnerability in a fundamental system library could lead to significant system compromise if successfully exploited.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in libxml2 allows a local attacker to achieve arbitrary code execution due to a stack-based buffer overflow. While requiring local access, the vulnerability\u0027s presence in a fundamental system library could lead to significant system compromise if exploited.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86140"
},
{
"category": "external",
"summary": "RHBZ#2528989",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528989"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86140",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86140"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86140",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86140"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340",
"url": "https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
"url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
}
],
"release_date": "2026-09-05T04:26:13.860000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-06T15:54:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:64463"
},
{
"category": "workaround",
"details": "To mitigate this, administrators should disable DTD processing and validation for untrusted documents within libxml2 parsers and restrict network access so only authorized users can submit XML data to the application. For robust defense-in-depth against buffer overflow exploitation, ensure the library and dependent applications are compiled with memory safety flags like stack canaries (-fstack-protector-strong) and bounds checking (_FORTIFY_SOURCE=2), while verifying that standard OS-level protections such as ASLR and Data Execution Prevention (NX/XD Bit) are active on the host system.",
"product_ids": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements"
},
{
"cve": "CVE-2026-86141",
"cwe": {
"id": "CWE-252",
"name": "Unchecked Return Value"
},
"discovery_date": "2026-09-05T04:41:02.707389+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528988"
}
],
"notes": [
{
"category": "description",
"text": "A NULL pointer dereference in libxml2\u0027s xmlRegNewParserCtxt function allows a local attacker to cause a denial of service (DoS). The flaw occurs when strlen() is called on an unverified pointer following a failed xmlStrdup() memory allocation, resulting in a process crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: libxml2: Denial of Service due to NULL pointer dereference in xmlRegNewParserCtxt",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A Low-severity NULL pointer dereference in libxml2\u0027s xmlRegNewParserCtxt function can cause a process crash during XML parsing via xmlRegexpCompile. Exploitation depends on forcing a memory allocation failure, presenting high attack complexity and limiting the impact strictly to local Denial of Service. No Red Hat products are affected by this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86141"
},
{
"category": "external",
"summary": "RHBZ#2528988",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528988"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86141",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86141"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86141",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86141"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/commit/e89a8aae4c9b40cdafcf66b3f9e57c62db37bb55",
"url": "https://github.com/GNOME/libxml2/commit/e89a8aae4c9b40cdafcf66b3f9e57c62db37bb55"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
"url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1107",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1107"
}
],
"release_date": "2026-09-05T04:27:59.795000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-06T15:54:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:64463"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 2.9,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "libxml2: libxml2: Denial of Service due to NULL pointer dereference in xmlRegNewParserCtxt"
},
{
"cve": "CVE-2026-86142",
"cwe": {
"id": "CWE-805",
"name": "Buffer Access with Incorrect Length Value"
},
"discovery_date": "2026-09-05T04:41:08.714165+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528990"
}
],
"notes": [
{
"category": "description",
"text": "A flaw in libxml2\u0027s xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer() expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure, data corruption, or a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A heap-based buffer overflow in libxml2\u0027s xmlXPtrEvalXPtrPart function enables an out-of-bounds write during the evaluation of oversized xpointer() expressions. The flaw is assigned a Moderate severity rating because exploitation strictly requires local access and complex, multi-gigabyte payload inputs, effectively mitigating the threat of remote or automated system compromise.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86142"
},
{
"category": "external",
"summary": "RHBZ#2528990",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528990"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86142",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86142"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86142",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86142"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58",
"url": "https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
"url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113"
}
],
"release_date": "2026-09-05T04:29:33.323000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-06T15:54:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:64463"
},
{
"category": "workaround",
"details": "To mitigate this applications should avoid passing untrusted XPointer expressions into xmlXPtrEval or XInclude xpointer= attributes and strictly cap input length well below INT_MAX. Additionally, administrators should enforce process or cgroup memory limits to prevent the construction of multi-gigabyte scheme bodies, relying on heap allocator hardening rather than standard fortify flags, which cannot stop this byte-store loop.",
"product_ids": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation"
},
{
"cve": "CVE-2026-86143",
"cwe": {
"id": "CWE-192",
"name": "Integer Coercion Error"
},
"discovery_date": "2026-09-05T04:40:59.552825+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528987"
}
],
"notes": [
{
"category": "description",
"text": "An integer overflow in the libxml2 xmlIO module occurs when data backlogs exceed maximum integer limits. This flaw passes negative length values to downstream write callbacks, creating an unsafe state that can lead to data corruption or compromise application confidentiality and integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate impact: This flaw in libxml2, a widely used XML parsing library, is due to an integer overflow in write callbacks. This can lead to negative lengths being passed to write operations, potentially causing data integrity issues in applications that process untrusted XML input and utilize affected write callbacks. The impact is limited to applications that specifically trigger this overflow condition.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86143"
},
{
"category": "external",
"summary": "RHBZ#2528987",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528987"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86143"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86143",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86143"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35",
"url": "https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
"url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111"
}
],
"release_date": "2026-09-05T04:31:21.187000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-06T15:54:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:64463"
},
{
"category": "workaround",
"details": "Cap process and cgroup memory so a process cannot build a \u22652 GiB libxml2 output backlog. Keep FORTIFY_SOURCE-built Red Hat binaries so some callback copies of the truncated length abort instead of corrupting memory",
"product_ids": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks"
},
{
"cve": "CVE-2026-86144",
"cwe": {
"id": "CWE-669",
"name": "Incorrect Resource Transfer Between Spheres"
},
"discovery_date": "2026-09-05T04:50:58.626617+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528992"
}
],
"notes": [
{
"category": "description",
"text": "A flaw in libxml2\u0027s XInclude processing (xmlXIncludeProcess and xmlXIncludeProcessTree) fails to propagate parser flags like XML_PARSE_NONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery (SSRF), XML External Entity (XXE) injection, or Denial of Service (DoS) attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A Moderate-severity flaw in libxml2 XInclude processing allows custom resource loaders to bypass network restriction flags, enabling unintended external network connections that could cause SSRF, information disclosure, or Denial of Service (DoS). Exploitation requires local access alongside high attack complexity, limiting its immediate widespread impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86144"
},
{
"category": "external",
"summary": "RHBZ#2528992",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528992"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86144",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86144"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86144",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86144"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61",
"url": "https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
"url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
}
],
"release_date": "2026-09-05T04:34:43.972000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-06T15:54:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:64463"
},
{
"category": "workaround",
"details": "Do not expand untrusted XInclude; parse without XML_PARSE_XINCLUDE and do not call xmlXIncludeProcess / xmlXIncludeProcessTree. If XInclude is required, pass XML_PARSE_NONET (and XML_PARSE_NO_XXE where available) via xmlXIncludeProcessFlags, and restrict outbound fetches.",
"product_ids": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libxml2-main@aarch64",
"Red Hat Hardened Images:libxml2-main@src",
"Red Hat Hardened Images:libxml2-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation."
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…