CVE-2026-6732Medium· 6.5▾ SunlitA flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.6%
A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.
libxml2 >= 2.13.0, < 2.15.3hardened_imagesjboss_core_servicesopenshift_container_platform = 4.0enterprise_linux = 6.0enterprise_linux = 7.0enterprise_linux = 8.0enterprise_linux = 9.0enterprise_linux = 10.0vios >= 4.1.0, < 4.1.1.30vios = 4.1.2.0aix >= 7.2.5, < 7.2.5.12aix >= 7.3.2, < 7.3.3.3aix = 7.3.4Upgrade past the affected range:
libxml2 2.15.3vios 4.1.1.30aix 7.3.3.3Connected by shared product, vendor, weakness, or advisory.
CVE-2025-7425High· 7.8A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management
CVE-2026-86144Medium· 5.6In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags
CVE-2026-86143Medium· 6.9In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback
CVE-2026-86142Medium· 6.9In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
CVE-2026-86141Low· 2.9xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.
CVE-2026-86140High· 8.0In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.