CVE-2026-74860

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.

Red Hat evaluates this vulnerability as having an Important severity because memory corruption resulting from the use-after-free condition could allow remote execution of arbitrary code within the parsing application's process context. Under typical Red Hat Enterprise Linux deployments, the risk is scoped strictly to Python services that invoke libxml2 push parser interfaces and register custom attribute declaration callbacks on untrusted inputs. Standard C-based libxml2 consumers and applications using tree-based parsing without these specific Python SAX bindings are not exposed to this defect.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.