CVE-2026-76781
Fixed in a distro release EPSS <1%CVSS 5.5
A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element lacks its mandatory `catalog` attribute, leading to the application crashing and causing a Denial of Service (DoS).
Products: Red Hat Hardened Images, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libxml2 | no fix |
| Debian 13 | libxml2 | no fix |
| Debian 14 | libxml2 | 2.15.4+dfsg-1 |
| Red Hat hummingbird 1 | libxml2 | 0:2.15.3-0.1.3.hum1 |
| Red Hat hummingbird 1 | libxml2-16 | 0:2.15.3-0.1.3.hum1 |
| Red Hat hummingbird 1 | libxml2-devel | 0:2.15.3-0.1.3.hum1 |
| Red Hat hummingbird 1 | libxml2-static | 0:2.15.3-0.1.3.hum1 |
| Red Hat hummingbird 1 | python3-libxml2 | 0:2.15.3-0.1.3.hum1 |
| Ubuntu 22.04 LTS | libxml2 | 2.9.13+dfsg-1ubuntu0.14 |
| Ubuntu 24.04 LTS | libxml2 | 2.9.14+dfsg-1.3ubuntu3.10 |
| Ubuntu 26.04 LTS | libxml2 | 2.15.2+dfsg-0.1ubuntu0.3 |
| Ubuntu Pro 14.04 LTS | libxml2 | 2.9.1+dfsg1-3ubuntu4.13+esm13 |
| Ubuntu Pro 16.04 LTS | libxml2 | 2.9.3+dfsg1-1ubuntu0.7+esm14 |
| Ubuntu Pro 18.04 LTS | libxml2 | 2.9.4+dfsg1-6.1ubuntu1.9+esm9 |
| Ubuntu Pro 20.04 LTS | libxml2 | 2.9.10+dfsg-5ubuntu0.20.04.10+esm6 |