CVE-2026-6653
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A Use After Free vulnerability in the xmlParseInternalSubset function of libxml2 versions 2.9.11 through 2.11.0 allows a remote attacker to cause a denial-of-service (DoS) via specially crafted XML input with improper entity resolution.
Risk Assessment
An attacker can remotely crash applications using libxml2, leading to service disruption and potential financial losses or system unavailability.
Recommendation
Immediately upgrade libxml2 to version 2.11.1 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.