CVE-2026-6653: gnome libxml2 Use After Free
Vulnerability summary
CVE-2026-6653 is a critical (CVSS 9.8) Use After Free vulnerability in gnome libxml2. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 27.6% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 22-06-2026PublishedVulnerability first disclosed.
- 22-06-2026Last modifiedVulnerability information updated.
Description
Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.
CVSS metrics
7 scores · 5 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.3HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:PDiffers
- NVDNIST7.0HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · Red hatEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.36%
Chance of exploitation in the next 30 days
Percentile
28%
Versus all other CVEs
30-day change
0.00 pp
From 0.36% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (bugs.launchpad.net)
Maturity: unknown
Exploit Reference (gitlab.gnome.org)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
- CWE-611Improper Restriction of XML External Entity ReferenceThe product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Affected systems
Redhat6 products
- libxml2< 0:2.9.7-21.el8_10.8
- libxml2-debuginfo< 0:2.9.7-21.el8_10.8
- libxml2-debugsource< 0:2.9.7-21.el8_10.8
- libxml2-devel< 0:2.9.7-21.el8_10.8
- python3-libxml2< 0:2.9.7-21.el8_10.8
Debian1 product
- libxml2All versions (No fix recorded) | < 2.14.5+dfsg-0.1
Gnome1 product
- libxml2≥ 2.9.11, < 2.11.0
Ubuntu1 product
- libxml2< 2.9.13+dfsg-1ubuntu0.12 | < 2.9.14+dfsg-1.3ubuntu3.8
Xmlsoft1 product
- libxml2≥ 2.9.11, ≤ 2.11.0
5 vendors · 10 products
References
13 links- bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260Issue TrackingARTICLEREPORTExploitThird Party Advisory
