CVE-2026-6732: Libxml2: libxml2: denial of service via crafted xsd-validated document
A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.
Other sources
xmlParseReference in parser.c passes ctxt instead of ctxt->userData to the SAX characters / cdataBlock callbacks when emitting the first or last text child of a cached entity tree (parser.c). Every other SAX callsite in the same file correctly passes ctxt->userData.
When xmlSchemaSAXPlug is active, which is the case for every user of xmlTextReaderSetSchema / xmlTextReaderSchemaValidate and for lxml's XMLParser(schema=...), ctxt->userData has been swapped to a xmlSchemaSAXPlug . Handing the confused charactersSplit handler a raw xmlParserCtxt causes it to dereference ctxt->myDoc as the forwarded SAX handler and call myDoc->URL as a function pointer, producing a reliable SIGSEGV on the first internal-entity reference in any XSD-validated document. If myDoc->URL is NULL, the secondary path (xmlSchemaSAXHandleText with a garbage plug pointer) crashes instead.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6732?
The severity of CVE-2026-6732 is rated as high due to its potential to cause a denial of service.
How do I fix CVE-2026-6732?
To fix CVE-2026-6732, update to the latest version of libxml2 that addresses this vulnerability.
Who is affected by CVE-2026-6732?
CVE-2026-6732 affects applications that utilize the libxml2 library for processing XSD-validated documents.
What impact does CVE-2026-6732 have on systems?
CVE-2026-6732 can lead to denial of service, rendering applications that rely on libxml2 inoperable when processing malicious XML documents.
What is the exploit vector for CVE-2026-6732?
The exploit vector for CVE-2026-6732 involves processing a specially crafted XML Schema Definition document containing an internal entity reference.