CVE-2026-74860: Libxml2: double-free/uaf in libxml2 python bindings

Severity: high (CVSS 8.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-08 · updated 2026-10-30
Weakness: CWE-763

Description

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.

Affected products

Red Hat Cert Manager support for Red Hat OpenShift release 1.20: all versions — fixed in 1790589912
Red Hat Cost Management On-Premise 1: all versions — fixed in 1791460851
Red Hat Enterprise Linux 10: all versions — fixed in 0:2.12.5-10.el10_2.4
Red Hat Enterprise Linux 10.0 Extended Update Support: all versions — fixed in 0:2.12.5-9.el10_0.9
Red Hat Enterprise Linux 7: all versions
Red Hat Enterprise Linux 8: all versions — fixed in 0:2.9.7-21.el8_10.9
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: all versions — fixed in 0:2.9.7-13.el8_6.24
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On: all versions — fixed in 0:2.9.7-13.el8_6.24
Red Hat Enterprise Linux 9: all versions — fixed in 0:2.9.13-14.el9_8.5
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: all versions — fixed in 0:2.9.13-3.el9_2.20
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions: all versions — fixed in 0:2.9.13-13.el9_4.10
Red Hat Enterprise Linux 9.6 Extended Update Support: all versions — fixed in 0:2.9.13-13.el9_6
Red Hat Hardened Images: all versions — fixed in 2.15.4-0.1.hum1
Red Hat OpenShift AI 3.0: all versions — fixed in 1793041986
Red Hat OpenShift AI 3.4: all versions — fixed in 1793042006
Red Hat OpenShift AI 3.5: all versions — fixed in 1793042010
Red Hat Update Infrastructure 5: all versions — fixed in 1791978534

How to fix

Upgrade to a fixed version: Red Hat Cert Manager support for Red Hat OpenShift release 1.20 1790589912; Red Hat Cost Management On-Premise 1 1791460851; Red Hat Enterprise Linux 10 0:2.12.5-10.el10_2.4; Red Hat Enterprise Linux 10.0 Extended Update Support 0:2.12.5-9.el10_0.9; Red Hat Enterprise Linux 8 0:2.9.7-21.el8_10.9; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:2.9.7-13.el8_6.24; Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 0:2.9.7-13.el8_6.24; Red Hat Enterprise Linux 9 0:2.9.13-14.el9_8.5; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:2.9.13-3.el9_2.20; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:2.9.13-13.el9_4.10; Red Hat Enterprise Linux 9.6 Extended Update Support 0:2.9.13-13.el9_6; Red Hat Hardened Images 2.15.4-0.1.hum1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-74860 or the next vulnerability affects your stack