Libxml2: double-free/uaf in libxml2 python bindings

Summary

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.

Timeline

1. Sep 8, 2026, 11:27 AM UTCCVE published
2. Sep 8, 2026, 12:08 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 30, 2026, 12:06 AM UTCRecord last updated

Affected versions

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• cert-manager/jetstack-cert-manager-rhel9

  Version range not reported

• cert-manager/cert-manager-istio-csr-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-rhel9

  Version range not reported

• costmanagement/costmanagement-ui-rhel10

  Version range not reported

• libxml2-main

  Version range not reported

• rhai/base-image-spyre-rhel9

  Version range not reported

• rhai/base-image-rocm-rhel9

  Version range not reported

• rhai/base-image-cpu-rhel9

  Version range not reported

• rhai/base-image-cuda-rhel9

  Version range not reported

• rhai/base-image-tpu-rhel9

  Version range not reported

• rhai/base-image-rocm-7.1-rhel9

  Version range not reported

• rhai/base-image-cuda-12.9-rhel9

  Version range not reported

• rhai/base-image-tpu-rhel9

  Version range not reported

• rhai/base-image-gaudi-rhel9

  Version range not reported

• rhai/base-image-cuda-13.0-rhel9

  Version range not reported

• rhai/base-image-cpu-rhel9

  Version range not reported

• rhai/base-image-rocm-6.4-rhel9

  Version range not reported

• rhai/base-image-spyre-rhel9

  Version range not reported

• rhai/base-image-neuron-rhel9

  Version range not reported

• rhai/base-image-tpu-rhel9

  Version range not reported

• rhai/base-image-cpu-rhel9

  Version range not reported

• rhai/base-image-gaudi-rhel9

  Version range not reported

• rhai/base-image-rubin-rhel9

  Version range not reported

• rhai/base-image-cuda-12.9-rhel9

  Version range not reported

• rhai/base-image-cuda-13.0-rhel9

  Version range not reported

• rhai/base-image-spyre-rhel9

  Version range not reported

• rhai/base-image-rocm-7.14-rhel9

  Version range not reported

• rhai/base-image-neuron-rhel9

  Version range not reported

• rhui5/cds-kubernetes-rhel9

  Version range not reported

• rhui5/cds-rhel9

  Version range not reported

• rhui5/haproxy-rhel9

  Version range not reported

• rhui5/installer-rhel9

  Version range not reported

• rhui5/rhua-rhel9

  Version range not reported

• podman

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• container-tools:rhel8/podman

  Version range not reported

• podman

  Version range not reported

• swift-lang

  Version range not reported

• openshift/ose-rhel-coreos-8

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• podman

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

References 28