RHSA-2026:64463HighCVSS 8.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
September 6, 2026
Last Modified
September 10, 2026

🔗 CVE IDs covered (9)

CVE-2026-86143 →CVE-2026-74860 →CVE-2026-86137 →CVE-2026-86140 →CVE-2026-86142 →CVE-2026-86144 →CVE-2026-86138 →CVE-2026-86139 →CVE-2026-86141 →

📋 Description

CVE-2026-74860 — libxml2: double-free/UAF in libxml2 Python bindings CVE-2026-86137 — libxml2: libxml2: Denial of Service via out-of-bounds read in xmlFAParsePosCharGroup CVE-2026-86138 — libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow CVE-2026-86139 — libxml2: libxml2: Integer overflow in xmlURIEscapeStr may lead to arbitrary code execution CVE-2026-86140 — libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements CVE-2026-86141 — libxml2: libxml2: Denial of Service due to NULL pointer dereference in xmlRegNewParserCtxt CVE-2026-86142 — libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation CVE-2026-86143 — libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks CVE-2026-86144 — libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.

🎯 Affected products4

  • Red Hat Hardened Images
  • libxml2-main@aarch64 as a component of Red Hat Hardened Images
  • libxml2-main@src as a component of Red Hat Hardened Images
  • libxml2-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Bound XML document and QName (prefix + local name) size before intern. Cap process and cgroup memory so a ~4 GiB dictionary pool cannot be built. Keep FORTIFY_SOURCE and heap hardening on Red Hat binaries. Workaround: To mitigate this developers must strictly cap URI and path lengths before passing data to libxml2 helpers to ensure multi-gigabyte strings cannot reach the vulnerable function. Furthermore, administrators should enforce strict process or cgroup memory limits to structurally prevent applications from allocating the excessively large buffers required to exceed maximum integer boundaries during string processing. Workaround: To mitigate this, administrators should disable DTD processing and validation for untrusted documents within libxml2 parsers and restrict network access so only authorized users can submit XML data to the application. For robust defense-in-depth against buffer overflow exploitation, ensure the library and dependent applications are compiled with memory safety flags like stack canaries (-fstack-protector-strong) and bounds checking (_FORTIFY_SOURCE=2), while verifying that standard OS-level protections such as ASLR and Data Execution Prevention (NX/XD Bit) are active on the host system. Workaround: To mitigate this applications should avoid passing untrusted XPointer expressions into xmlXPtrEval or XInclude xpointer= attributes and strictly cap input length well below INT_MAX. Additionally, administrators should enforce process or cgroup memory limits to prevent the construction of multi-gigabyte scheme bodies, relying on heap allocator hardening rather than standard fortify flags, which cannot stop this byte-store loop. Workaround: Cap process and cgroup memory so a process cannot build a ≥2 GiB libxml2 output backlog. Keep FORTIFY_SOURCE-built Red Hat binaries so some callback copies of the truncated length abort instead of corrupting memory Workaround: Do not expand untrusted XInclude; parse without XML_PARSE_XINCLUDE and do not call xmlXIncludeProcess / xmlXIncludeProcessTree. If XInclude is required, pass XML_PARSE_NONET (and XML_PARSE_NO_XXE where available) via xmlXIncludeProcessFlags, and restrict outbound fetches.

🔗 References (13)