This vulnerability in libxml2's Python bindings arises from a double-free error in the SAX attributeDecl callback handler when processing a crafted XML document with a DTD containing enumerated attribute values. The double-free occurs because a string is freed twice, leading to memory corruption and a reproducible crash. The flaw can be exploited remotely by an attacker providing malicious XML input, resulting in denial of service in Python applications that use libxml2 SAX bindings. The CVSS v3.1 score is 8.5, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, low privileges required, and no user interaction needed. Red Hat is the authoritative source for this vulnerability affecting Red Hat Enterprise Linux 10, but no official fix or patch has been confirmed yet.

The vulnerability allows a remote attacker to cause a denial of service by crashing Python applications that use libxml2 SAX bindings through a crafted XML input. The flaw impacts confidentiality, integrity, and availability due to memory corruption from a double-free error. There are no known exploits in the wild at this time. The attack requires low privileges but has high attack complexity.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-74860 for current remediation guidance. No official fix or patch has been announced as of the latest advisory. Users should monitor the vendor advisory for updates. No specific mitigations are provided by Red Hat at this time.