CVE-2026-76781: Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute
A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a nextCatalog element lacks its mandatory catalog attribute, leading to the application crashing and causing a Denial of Service (DoS).
Other sources
A NULL pointer dereference flaw was found in libxml2 XML catalog parsing. When a catalog contains a nextCatalog element without the mandatory catalog attribute, xmlParseXMLCatalogOneNode() returns NULL, but the nextCatalog deduplication loop dereferences the entry before the existing NULL check, crashing the application.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using libxml2 XML catalog parsing are exposed when they process a crafted XML catalog supplied by a local user or an attacker. The triggering condition is a nextCatalog element that omits the required catalog attribute.
Does an attacker need elevated privileges to trigger the crash?
No privileges are required according to the supplied severity vector. An attacker must be able to cause the affected application to parse the specially crafted XML catalog.
What is the security impact if exploitation succeeds?
The affected application crashes because a NULL entry is dereferenced in the nextCatalog deduplication loop. The stated impact is denial of service; no confidentiality or integrity impact is indicated.