CVE-2026-74860: Libxml2: double-free/uaf in libxml2 python bindings
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Python applications that use the libxml2 SAX bindings are exposed when they parse attacker-controlled XML. The vulnerable condition requires libxml2 to be built or used with Python bindings enabled.
What must an attacker provide to trigger the flaw?
An attacker needs to supply a specially crafted XML document containing a DTD with enumerated attribute values. Exploitation is remote, but the attacker must be able to cause the application to parse that XML.
What is the confirmed impact?
The described, reproducible impact is a crash and resulting denial of service in affected Python applications. The underlying error is a double-free in the SAX attributeDecl callback handler.