CVE-2026-76781— Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 libxml2 中发现了一个漏洞。本地用户或攻击者可以通过提供一份经过特殊构造的 XML 目录（XML catalog）文件，在解析 XML 目录过程中触发空指针解引用（NULL pointer dereference）。具体而言，当 元素缺少其必需的 属性时，会导致应用程序崩溃，从而引发拒绝服务（Denial of Service, DoS）攻击。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76781
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element lacks its mandatory `catalog` attribute, leading to the application crashing and causing a Denial of Service (DoS).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Hardened Images | - |
cpe:/a:redhat:hummingbird:1
|
|
| Red Hat | Red Hat Hardened Images | - |
cpe:/a:redhat:hummingbird:1
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
II. Public POCs for CVE-2026-76781
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76781
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-76781 (2)
Vendor Advisories for CVE-2026-76781 (1)
Other References for CVE-2026-76781 (1)
Same Patch Batch · Red Hat · 2026-09-17 · 8 CVEs total
| CVE-2026-86320 | 7.8 HIGH | Flatpak-builder: host code execution via `git am` hook execution in patch source extractio |
| CVE-2026-87742 | 7.5 HIGH | Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded |
| CVE-2026-92925 | 7.1 HIGH | Redis: redis: out-of-bounds read via crafted cluster bus packets |
| CVE-2026-81829 | 5.3 MEDIUM | Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via uns |
| CVE-2026-92904 | 4.3 MEDIUM | Rubygem-foreman_remote_execution: job output readable without object-level view_job_invoca |
| CVE-2026-92893 | 4.3 MEDIUM | Rubygem-foreman_ansible: ansible inventory api ignores view_hosts permission filters, expo |
| CVE-2026-92894 | 4.3 MEDIUM | Rubygem-foreman_ansible: unscoped lookupvalue deletion allows cross-model override value d |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-86320
Flatpak-builder: host code execution via `git am` hook execu -
CVE-2025-11395
Podman: arbitrary file write when importing oci archive -
CVE-2026-85234
Tftp: tftp-hpa: denial of service due to out-of-bounds read/ -
CVE-2026-85013
Environment-modules: command injection in environment-module -
CVE-2026-91786
Gnome-shell: gnome-shell: out-of-bounds read in remote searc
Same vendor: Red Hat
-
CVE-2026-87742
Quarkus-websockets-next: denial of service (oom) in quarkus- -
CVE-2026-81829
Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenti -
CVE-2026-92904
Rubygem-foreman_remote_execution: job output readable withou -
CVE-2026-92925
Redis: redis: out-of-bounds read via crafted cluster bus pac -
CVE-2026-92893
Rubygem-foreman_ansible: ansible inventory api ignores view_
Same weakness: CWE-476
-
CVE-2026-92417
Open5GS PFCP types.c ogs_pfcp_parse_volume_measurement null -
CVE-2026-92413
Artifex MuPDF PDF Xref Loading pdf-stream.c pdf_open_filter -
CVE-2026-92626
Control iD iDSecure Unauthenticated Denial of Service -
CVE-2026-77692
Unauthenticated remote crash of named via a single DoH SIG(0 -
CVE-2026-76868
Netcore NR255-V 1.5.130703 NULL Pointer Dereference in route
V. Comments for CVE-2026-76781
No comments yet