CVE-2026-6653CWE-416CWE-611

libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling

High · published June 22, 2026

CVSS v4.0
7.0
EPSS
0%
Percentile
28.0
In the wild
Unconfirmed
What it is

Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.

The record
Technical detail
CVSS v4.0
7.0 · HIGH
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00355 · 28.0th percentile
Weaknesses
CWE-416 · Use After Free; CWE-611 · Improper Restriction of XML External Entity Reference
Published
2026-06-22T12:40Z
EPSS history
Timeline
  • 22 JUN 12:40Z
    libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling
    cvelistv5