ZeroDay Findings
Sign inSign up

Findings

CVE-2026-74860

A flaw was found in libxml2 with Python bindings enabled.

Published Sep 8, 2026 · updated Oct 14, 2026

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 8, 2026 · NIST NVD

    Detected

    A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a re

  2. Oct 14, 2026 · NIST NVD

    Updated

    A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a re

Sources

  • CVE.orgVulnerability recordCVE-2026-74860

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-74860

    30-day exploitation probability 0.4%

    first.org
  • NIST NVDVulnerability recordCVE-2026-74860

    A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX at

    nvd.nist.gov

References