CVE-2026-76781

Summary

A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a nextCatalog element lacks its mandatory catalog attribute, leading to the application crashing and causing a Denial of Service (DoS).

Affected Software

VendorProductVersion RangeStatus

Weaknesses

  • CWE-476: NULL Pointer Dereference

Workarounds

To mitigate this issue, avoid processing untrusted XML catalog files with applications linked against libxml2. Users should exercise caution when opening or processing XML documents from untrusted sources, as a malicious catalog could lead to application crashes. Where possible, restrict the ability of applications to load external XML catalogs, or ensure that only trusted catalog files are used.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References