# CVE-2026-74860: Libxml2: double-free/uaf in libxml2 python bindings Status: published. Published: 2026-09-08. Updated: 2026-11-02. A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings. ## Remediation No remediation reported in collected sources ## Affected products and versions - Red Hat / Red Hat Enterprise Linux 10 (libxml2): ≥ 0:2.12.5-10.el10_2.4; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 10.0 Extended Update Support (libxml2): ≥ 0:2.12.5-9.el10_0.9; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 8 (libxml2): ≥ 0:2.9.7-21.el8_10.9; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support (libxml2): ≥ 0:2.9.7-9.el8_4.20; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On (libxml2): ≥ 0:2.9.7-9.el8_4.20; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support (libxml2): ≥ 0:2.9.7-13.el8_6.24; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On (libxml2): ≥ 0:2.9.7-13.el8_6.24; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 8.8 Telecommunications Update Service (libxml2): ≥ 0:2.9.7-16.el8_8.24; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions (libxml2): ≥ 0:2.9.7-16.el8_8.24; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 9 (libxml2): ≥ 0:2.9.13-14.el9_8.5; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions (libxml2): ≥ 0:2.9.13-3.el9_2.20; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions (libxml2): ≥ 0:2.9.13-13.el9_4.10; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 9.6 Extended Update Support (libxml2): ≥ 0:2.9.13-13.el9_6; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Cert Manager support for Red Hat OpenShift release 1.20 (cert-manager/jetstack-cert-manager-rhel9): ≥ 1790589912; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Cert Manager support for Red Hat OpenShift release 1.20 (cert-manager/cert-manager-istio-csr-rhel9): ≥ 1790589914; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Cert Manager support for Red Hat OpenShift release 1.20 (cert-manager/cert-manager-operator-rhel9): ≥ 1790589855; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat Cost Management On-Premise 1 (costmanagement/costmanagement-ui-rhel10): ≥ 1791460851; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat Hardened Images (libxml2-main): ≥ 2.15.4-0.1.hum1; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat OpenShift AI 3.0 (rhai/base-image-spyre-rhel9): ≥ 1793041986; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat OpenShift AI 3.0 (rhai/base-image-rocm-rhel9): ≥ 1793041981; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat OpenShift AI 3.0 (rhai/base-image-cpu-rhel9): ≥ 1793042072; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat OpenShift AI 3.0 (rhai/base-image-cuda-rhel9): ≥ 1793042067; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat OpenShift AI 3.0 (rhai/base-image-tpu-rhel9): ≥ 1793041987; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat OpenShift AI 3.4 (rhai/base-image-rocm-7.1-rhel9): ≥ 1793042006; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat OpenShift AI 3.4 (rhai/base-image-cuda-12.9-rhel9): ≥ 1793042145; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat OpenShift AI 3.4 (rhai/base-image-tpu-rhel9): ≥ 1793042006; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat OpenShift AI 3.4 (rhai/base-image-gaudi-rhel9): ≥ 1793042011; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat OpenShift AI 3.4 (rhai/base-image-cuda-13.0-rhel9): ≥ 1793042086; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat OpenShift AI 3.4 (rhai/base-image-cpu-rhel9): ≥ 1793042088; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat OpenShift AI 3.4 (rhai/base-image-rocm-6.4-rhel9): ≥ 1793041995; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat OpenShift AI 3.4 (rhai/base-image-spyre-rhel9): ≥ 1793042074; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat OpenShift AI 3.4 (rhai/base-image-neuron-rhel9): ≥ 1793042008; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat OpenShift AI 3.5 (rhai/base-image-tpu-rhel9): ≥ 1793042010; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat OpenShift AI 3.5 (rhai/base-image-cpu-rhel9): ≥ 1793042162; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat OpenShift AI 3.5 (rhai/base-image-gaudi-rhel9): ≥ 1793042004; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat OpenShift AI 3.5 (rhai/base-image-rubin-rhel9): ≥ 1793042092; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat OpenShift AI 3.5 (rhai/base-image-cuda-12.9-rhel9): ≥ 1793042117; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat OpenShift AI 3.5 (rhai/base-image-cuda-13.0-rhel9): ≥ 1793042093; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat OpenShift AI 3.5 (rhai/base-image-spyre-rhel9): ≥ 1793042114; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat OpenShift AI 3.5 (rhai/base-image-rocm-7.14-rhel9): ≥ 1793042024; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat OpenShift AI 3.5 (rhai/base-image-neuron-rhel9): ≥ 1793042008; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat Update Infrastructure 5 (rhui5/cds-kubernetes-rhel9): ≥ 1791978534; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat Update Infrastructure 5 (rhui5/cds-rhel9): ≥ 1791978528; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat Update Infrastructure 5 (rhui5/haproxy-rhel9): ≥ 1791978528; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat Update Infrastructure 5 (rhui5/installer-rhel9): ≥ 1791964013; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat Update Infrastructure 5 (rhui5/rhua-rhel9): ≥ 1791978693; < * (unaffected, rpm). Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 10 (podman): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 6 (libxml2): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 7 (libxml2): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 8 (container-tools:rhel8/podman): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Enterprise Linux 9 (podman): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Hardened Images (swift-lang): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat OpenShift Container Platform 4 (openshift/ose-rhel-coreos-8): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat OpenShift Container Platform 4 (openshift/ose-rhel-coreos-9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat OpenShift Container Platform 4 (podman): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat OpenShift Container Platform 5 (openshift/ose-rhel-coreos-9): Version range not reported. Source: CNA: redhat ## Severity and prioritization - CVSS 3.1: 8.5 (high); CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H; source: CNA: redhat - CISA KEV: No listing in collected sources - EPSS: 0.66% as of 2026-11-01; percentile 51.48% - SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP - Weaknesses: CWE-763 ## Exploit evidence No exploit evidence in collected sources. This is not proof of no exploitation. ## References - https://access.redhat.com/errata/RHSA-2026:64463 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:71585 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:71586 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:71641 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:72470 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:72475 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:72476 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:79357 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:82939 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:89750 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:89759 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:90309 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:91202 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:91204 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:91206 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:91207 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:91217 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:91218 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:91219 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:91224 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:91232 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:91233 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:91234 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:91235 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:91236 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:91237 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:91238 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:91241 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:91242 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:91243 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:91244 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:91245 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:91246 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:91248 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:91249 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:92352 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:92589 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:93463 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/errata/RHSA-2026:93473 (CNA: redhat; vendor-advisory, x_refsource_REDHAT) - https://access.redhat.com/security/cve/CVE-2026-74860 (CNA: redhat; vdb-entry, x_refsource_REDHAT) - https://bugzilla.redhat.com/show_bug.cgi?id=2529697 (CNA: redhat; issue-tracking, x_refsource_REDHAT) ## Provenance - CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-74860; retrieved 2026-11-02; source updated 2026-11-02 - FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-74860; retrieved 2026-11-02; source updated Not reported Revision: aa87d06b913a84fbe591f38c5b98382288eaedffa5c0a68583f35a1038785895 Canonical: https://y2.dev/cve/CVE-2026-74860