RLSA-2026:98572: Important: libxml2 security update
The libxml2 library is a development toolbox providing the implementation of various XML standards.
Security Fix(es):
libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow (CVE-2026-11979)
libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks (CVE-2026-86143)
libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements (CVE-2026-86140)
libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation (CVE-2026-86142)
libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation. (CVE-2026-86144)
libxml2: double-free/UAF in libxml2 Python bindings (CVE-2026-74860)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/libxml2-staticto a version that resolves this vulnerability.Fixed in 0:2.12.5-15.el10_3.2 - Upgrade
Upgrade
rocky-linux/libxml2-develto a version that resolves this vulnerability.Fixed in 0:2.12.5-15.el10_3.2 - Upgrade
Upgrade
rocky-linux/libxml2to a version that resolves this vulnerability.Fixed in 0:2.12.5-15.el10_3.2 - Upgrade
Upgrade
rocky-linux/libxml2-debugsourceto a version that resolves this vulnerability.Fixed in 0:2.12.5-15.el10_3.2 - Upgrade
Upgrade
rocky-linux/python3-libxml2-debuginfoto a version that resolves this vulnerability.Fixed in 0:2.12.5-15.el10_3.2 - Upgrade
Upgrade
rocky-linux/python3-libxml2to a version that resolves this vulnerability.Fixed in 0:2.12.5-15.el10_3.2 - Upgrade
Upgrade
rocky-linux/libxml2-debuginfoto a version that resolves this vulnerability.Fixed in 0:2.12.5-15.el10_3.2
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which installed packages are covered by this update?
The advisory covers rocky-linux libxml2, libxml2-devel, libxml2-static, libxml2-debugsource, libxml2-debuginfo, python3-libxml2, python3-libxml2-debuginfo, and libxml2-debugsource packages.
What kinds of impact are addressed by the listed fixes?
The fixes address arbitrary code execution, data integrity issues, information disclosure, server-side request forgery, and denial of service. The underlying flaw classes include buffer overflows, integer overflow, improper parseFlags propagation, and a double-free/use-after-free issue in the Python bindings.
Does exploitation require an authenticated or otherwise privileged attacker?
The supplied vector indicates low privileges are required and no user interaction is required. It also indicates network reachability, high attack complexity, and scope change.