CVE-2026-6653

CRITICAL

Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.

CVSS v3.1 Score

9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Published: 6/22/2026Modified: 10/25/2026

Related Intelligence (1)

CRITICALApt

Hitachi Energy RTU500 Product

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-293-05.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Hitachi Energy is aware of vulnerabilities that affect RTU500 product versions listed in this document. These vulnerabilities if exploited can have impact on confidentiality, integrity and availability of the product. Please refer to

CVE-2026-17539CVE-2026-28388
CISA Advisories

References (2)

https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260ExploitIssue Trackinghttps://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058ExploitIssue Tracking