Log in Start free

Vulnerability · Published Jun 22, 2026 · Assigned by canonical

CVE-2026-6653libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling

High 7.0

In plain English

A high-severity use-after-free in libxml2 from GNOME. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.0High
Exploit odds (30 days)0.4%top 70.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8libxml22.9.7-21.el8_10.8ALSA-2026:69655
AlmaLinux:9libxml22.9.13-14.el9_8.4ALSA-2026:61247
AlmaLinux:8libxml2-devel2.9.7-21.el8_10.8ALSA-2026:69655
AlmaLinux:9libxml2-devel2.9.13-14.el9_8.4ALSA-2026:61247
AlmaLinux:8python3-libxml22.9.7-21.el8_10.8ALSA-2026:69655
AlmaLinux:9python3-libxml22.9.13-14.el9_8.4ALSA-2026:61247
Debian:12libxml2no fix listedDEBIAN-CVE-2026-6653
Debian:13libxml2no fix listedDEBIAN-CVE-2026-6653
Debian:14libxml22.14.5+dfsg-0.1DEBIAN-CVE-2026-6653
Rocky Linux:8libxml20:2.9.7-21.el8_10.8RLSA-2026:69655
Rocky Linux:9libxml20:2.9.13-14.el9_8.4RLSA-2026:61247
Ubuntu:22.04:LTSlibxml22.9.13+dfsg-1ubuntu0.12UBUNTU-CVE-2026-6653
Ubuntu:24.04:LTSlibxml22.9.14+dfsg-1.3ubuntu3.8UBUNTU-CVE-2026-6653

Affected products (as reported)

VendorProductVersions
GNOME libxml2 2.9.11 – before 2.11.0

Weakness: CWE-416, CWE-611 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References