This vulnerability arises from a flaw in libxml2's handling of XML Schema Definition documents with internal entity references, leading to type confusion. When a maliciously crafted document is processed, the type confusion error causes the application to crash, causing denial of service. The issue affects Red Hat Hardened Images that include vulnerable libxml2 versions. Red Hat has issued updated RPM packages (libxml2-2.15.3-0.1.hum1) for multiple architectures to fix the problem. The CVSS 3.1 base score is 6.5, reflecting medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability.

Successful exploitation results in denial of service by crashing the affected application or system component using libxml2. There is no impact on confidentiality or integrity. No known exploits are currently reported in the wild.

Red Hat has released updated libxml2 RPM packages as part of Red Hat Hardened Images to fix this vulnerability. Users should apply the update described in Red Hat advisory RHSA-2026:11503 to remediate the issue. Patch status is confirmed by the vendor advisory. No additional mitigation is indicated.