CVE-2026-6653 Details
Description
Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.
A use-after-free vulnerability has been identified in GNOME libxml2 versions 2.9.11 prior to 2.11.0. The issue arises in the xmlParseInternalSubset function, where improper handling of entity references in the internal subset of a DTD can lead to unauthorized memory access. This vulnerability allows remote attackers to craft malicious XML input that, when processed, causes a denial-of-service by crashing the application. The vulnerability was introduced by a regression in the CVE-2021-3541 fix, which improperly freed an input stream before it was fully processed.
Users can upgrade to GNOME libxml2 version 2.11.0 or later, where this vulnerability has been fixed. For Ubuntu users, the patched version is available in the libxml2 package version 2.9.14+dfsg-1.3ubuntu3.8.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260 | [email protected] | ExploitIssue TrackingThird Party Advisory |
| https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058 | [email protected] | ExploitIssue TrackingPatch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
| CWE-611 | Improper Restriction of XML External Entity Reference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| xmlsoft libxml2 | >= 2.9.11, <= 2.11.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | Initial Analysis | [email protected] |
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |