Read the docs
Red Hat Security Advisory

RHSA-2026:89759

libxml2 security update

Released 2026-10-26 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 7 records

TI-2026-52582 CVE-2026-74860 · GHSA-8626-cqqj-mfff

Libxml2: double-free/uaf in libxml2 python bindings

Priority MEDIUM 40

A flaw was found in libxml2 with Python bindings enabled.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00658 Published 2026-09-08 Partial fix · 2.12.5-10.el10_2.4, 2.12.5-9.el10_0.9 +43 CWE-763
TI-2026-58936 CVE-2026-86142 · GHSA-499q-6rmh-w6p7

Heap-based buffer overflow in xmlsoft libxml2

Priority LOW 35

In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00157 Published 2026-09-05 Partial fix · 2.15.4 CWE-122
TI-2026-58937 CVE-2026-86143 · GHSA-r2q6-6v35-773j

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and…

Priority LOW 33

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback.

CVSS 3.1HIGH 7.3 Local Low privileges No interaction EPSS 0.00194 Published 2026-09-05 Partial fix · 2.15.4 CWE-192
TI-2026-10322 CVE-2026-11979 · GHSA-h67q-h62w-5mjr

Stack-Based Buffer Overflow in libxml2

Priority LOW 9

libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode.

CVSS 4.0LOW 1.8 Local No auth User interaction EPSS 0.00148 Published 2026-06-29 Partial fix CWE-121