CVE-2026-6653: libxml2 Use-After-Free in xmlParseInternalSubset Causing Denial of Service

Overview

CVE-2026-6653 describes a use-after-free condition in the xmlParseInternalSubset function of GNOME libxml2. The record associates it with improper entity resolution handling and classifies it under CWE-416. The described outcome is denial of service.

Impact

The record states that a remote attacker can cause denial of service by supplying maliciously crafted XML input.
The NVD assigns CVSS 3.1 base score 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which reflects network reachability and high impact ratings on confidentiality, integrity and availability.
The Ubuntu CNA lists a CVSS 4.0 score of 7. The record does not explain the difference between the two scores.
Whether the flaw can be used for anything beyond denial of service is unknown from the available record.

Affected products and versions

Product: Xmlsoft Libxml2 (GNOME libxml2).
Range listed in the record: versions greater than or equal to 2.9.11 and less than or equal to 2.11.0.
Versions outside this range are not stated as affected in the record, but the record does not confirm that they are unaffected.

Exploitation status

The CISA KEV catalog does not list this CVE in the record provided.
No confirmed active exploitation or exploitation in the wild appears in the sources consulted.
The reference entries carry an Exploit tag in the metadata. This tag does not, by itself, establish that exploitation has occurred.

Remediation and mitigation

The record links a patch in the GNOME libxml2 issue tracker. Review that patch and the upstream project information to determine the first fixed release.
Inventory systems and applications that embed or depend on libxml2 within the affected range, including bundled copies inside third-party software.
Prioritize updates for internet-facing services and components that parse XML from untrusted sources.
Until a fixed version is deployed, consider limiting exposure of XML parsing functions to trusted input, following your organization's compensating-control policy.

Detection guidance

Monitor services that parse XML for unexpected crashes, restarts or memory-related errors, which may indicate attempts to trigger the flaw.
Review application logs for repeated failed or abnormal XML processing requests from external sources.
Track the Ubuntu and GNOME advisories for updates to the vulnerability status.

Limitations of the available information

The record does not state a fixed version number.
The record does not provide technical details of the trigger conditions, and this analysis does not add them.
No EPSS score, SSVC data or KEV details are present in the record.
The discrepancy between the NVD CVSS 3.1 score and the Ubuntu CVSS 4.0 score is not explained.

Frequently asked questions

What versions of libxml2 are listed as affected by CVE-2026-6653?

The record lists GNOME libxml2 versions greater than or equal to 2.9.11 and less than or equal to 2.11.0 as affected.

Is CVE-2026-6653 known to be actively exploited?

The CISA KEV catalog does not list it in the record provided, and no confirmed active exploitation appears in the sources consulted.

What is the fixed version?

The record does not state a fixed version. It links a patch in the GNOME libxml2 issue tracker, which should be reviewed to determine the first fixed release.

Why are there two different CVSS scores?

The NVD lists CVSS 3.1 with a score of 9.8, while the Ubuntu CNA lists CVSS 4.0 with a score of 7. The record does not explain the difference.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.