CVE-2026-6732
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
A type confusion flaw was found in libxml2 when processing a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker can exploit this by providing a malicious document, causing the application to crash.
Risk Assessment
The risk is a denial of service (DoS) attack where a remote attacker can send a crafted XML document, making the affected system or application unavailable.
Recommendation
It is recommended to immediately update libxml2 to the latest patched version. Consider restricting processing of untrusted XML documents with XSD definitions.
Original NVD description (English source)
A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.