RHSA-2026:71585HighCVSS 8.5

Red Hat Security Advisory: libxml2 security update

Published
September 24, 2026
Last Modified
October 14, 2026

🔗 CVE IDs covered (6)

CVE-2026-86144 →CVE-2026-74860 →CVE-2026-86138 →CVE-2026-86140 →CVE-2026-86142 →CVE-2026-86143 →

📋 Description

CVE-2026-74860 — libxml2: double-free/UAF in libxml2 Python bindings CVE-2026-86138 — libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow CVE-2026-86140 — libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements CVE-2026-86142 — libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation CVE-2026-86143 — libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks CVE-2026-86144 — libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.

🎯 Affected products47

  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • libxml2-0:2.9.13-14.el9_8.5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libxml2-0:2.9.13-14.el9_8.5.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libxml2-0:2.9.13-14.el9_8.5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libxml2-0:2.9.13-14.el9_8.5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libxml2-0:2.9.13-14.el9_8.5.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libxml2-0:2.9.13-14.el9_8.5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libxml2-debuginfo-0:2.9.13-14.el9_8.5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libxml2-debuginfo-0:2.9.13-14.el9_8.5.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libxml2-debuginfo-0:2.9.13-14.el9_8.5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libxml2-debuginfo-0:2.9.13-14.el9_8.5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libxml2-debuginfo-0:2.9.13-14.el9_8.5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libxml2-debugsource-0:2.9.13-14.el9_8.5.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libxml2-debugsource-0:2.9.13-14.el9_8.5.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libxml2-debugsource-0:2.9.13-14.el9_8.5.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libxml2-debugsource-0:2.9.13-14.el9_8.5.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libxml2-debugsource-0:2.9.13-14.el9_8.5.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libxml2-debugsource-0:2.9.13-14.el9_8.5.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libxml2-devel-0:2.9.13-14.el9_8.5.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libxml2-devel-0:2.9.13-14.el9_8.5.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • +17 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Bound XML document and QName (prefix + local name) size before intern. Cap process and cgroup memory so a ~4 GiB dictionary pool cannot be built. Keep FORTIFY_SOURCE and heap hardening on Red Hat binaries. Workaround: To mitigate this, administrators should disable DTD processing and validation for untrusted documents within libxml2 parsers and restrict network access so only authorized users can submit XML data to the application. For robust defense-in-depth against buffer overflow exploitation, ensure the library and dependent applications are compiled with memory safety flags like stack canaries (-fstack-protector-strong) and bounds checking (_FORTIFY_SOURCE=2), while verifying that standard OS-level protections such as ASLR and Data Execution Prevention (NX/XD Bit) are active on the host system. Workaround: To mitigate this applications should avoid passing untrusted XPointer expressions into xmlXPtrEval or XInclude xpointer= attributes and strictly cap input length well below INT_MAX. Additionally, administrators should enforce process or cgroup memory limits to prevent the construction of multi-gigabyte scheme bodies, relying on heap allocator hardening rather than standard fortify flags, which cannot stop this byte-store loop. Workaround: Cap process and cgroup memory so a process cannot build a ≥2 GiB libxml2 output backlog. Keep FORTIFY_SOURCE-built Red Hat binaries so some callback copies of the truncated length abort instead of corrupting memory Workaround: Do not expand untrusted XInclude; parse without XML_PARSE_XINCLUDE and do not call xmlXIncludeProcess / xmlXIncludeProcessTree. If XInclude is required, pass XML_PARSE_NONET (and XML_PARSE_NO_XXE where available) via xmlXIncludeProcessFlags, and restrict outbound fetches.

🔗 References (9)