CVE-2026-74860— Libxml2: double-free/uaf in libxml2 python bindings
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
当启用 Python 绑定的 libxml2 中存在一个缺陷。远程攻击者可以通过提供一个包含枚举属性值的文档类型定义（DTD）的精心构造的 XML 文档来利用此漏洞。这会在 SAX attributeDecl 回调处理器中触发双重释放（double-free）错误，即同一个字符串被释放了两次。该缺陷可能导致使用 libxml2 SAX 绑定的 Python 应用发生可复现的崩溃，从而引发拒绝服务（DoS）。
Possible ATT&CK Techniques 1 AI
T1203 · Exploitation for Client ExecutionAffected Version Matrix 13
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | any |
affected |
any |
affected | ||
| Red Hat | Red Hat Enterprise Linux 6 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 7 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 8 | any |
affected |
any |
affected | ||
| Red Hat | Red Hat Enterprise Linux 9 | any |
affected |
any |
affected | ||
| Red Hat | Red Hat Hardened Images | any |
unknown |
any |
unknown | ||
| Red Hat | Red Hat OpenShift Container Platform 4 | any |
unaffected |
any |
unaffected | ||
any |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-74860
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Libxml2: double-free/uaf in libxml2 python bindings
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对无效指针或索引的释放
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Hardened Images | - |
cpe:/a:redhat:hummingbird:1
|
|
| Red Hat | Red Hat Hardened Images | - |
cpe:/a:redhat:hummingbird:1
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
II. Public POCs for CVE-2026-74860
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-74860
请登录查看更多情报信息。
Other References for CVE-2026-74860 (1)
Same Patch Batch · Red Hat · 2026-09-08 · 8 CVEs total
| CVE-2026-78234 | 9.9 CRITICAL | Hawtio-operator: hawtio-operator: service-ca signing oracle allows arbitrary-cn certificat |
| CVE-2026-80219 | 8.7 HIGH | Hawtio-operator: hawtio-operator: oauthclient created with grantmethod auto and no secret |
| CVE-2026-77968 | 8.2 HIGH | Hawtio-operator: hawtio-operator: cluster-wide secrets read/write granted to operator serv |
| CVE-2026-76561 | 7.2 HIGH | Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile con |
| CVE-2026-74859 | 6.8 MEDIUM | Gnome-tweaks: path traversal in theme installer |
| CVE-2026-18090 | 6.1 MEDIUM | Gdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompress() via crafted icns rle block |
| CVE-2026-86564 | 3.3 LOW | Dpdk: dpdk: missing length validation before reading command_data in virtio-net control qu |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-18090
Gdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompres -
CVE-2026-86469
Glib2: toctou symlink race in `g_file_create_replace_destina -
CVE-2026-79678
Freeipa: idm: freeipa: idp-add eval() reachable before autho -
CVE-2026-76578
Ipa: freeipa: freeipa: unauthenticated ldap client can obtai -
CVE-2026-76925
Flatpak: flatpak: toctou race condition allows symlink redir
Same vendor: Red Hat
-
CVE-2026-86564
Dpdk: dpdk: missing length validation before reading command -
CVE-2026-18090
Gdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompres -
CVE-2026-80219
Hawtio-operator: hawtio-operator: oauthclient created with g -
CVE-2026-78234
Hawtio-operator: hawtio-operator: service-ca signing oracle -
CVE-2026-77968
Hawtio-operator: hawtio-operator: cluster-wide secrets read/
Same weakness: CWE-763
-
CVE-2026-77500
Windows Device Association Service Elevation of Privilege Vu -
CVE-2026-16005
ASUS Armoury Crate驱动：释放无效指针致系统崩溃 -
CVE-2023-20511
AMD Radeon 资源管理错误漏洞 -
CVE-2026-57248
Foxit PDF Editor/Reader Annotation Improper Release Vulnerab -
CVE-2026-9516
Cpanel::JSON::XS versions before 4.41 for Perl allow denial
V. Comments for CVE-2026-74860
No comments yet