Red Hat issued a security advisory (RHSA-2026:64463) for Red Hat Hardened Images RPMs containing libxml2 packages updated to version 2.15.4-0.1.hum1 for aarch64 and x86_64 architectures. The advisory addresses eight CVEs including CVE-2026-86137, which is an out-of-bounds read vulnerability in the xmlFAParsePosCharGroup function during XML regular expression parsing. This flaw can lead to denial of service by causing application crashes or instability when processing malicious XML input. The vulnerability requires local access and has high attack complexity, resulting in a low impact rating. Red Hat provides updated RPMs to remediate these issues. No known exploits in the wild have been reported.

The primary impact of CVE-2026-86137 is a denial of service condition caused by an out-of-bounds read in libxml2's xmlFAParsePosCharGroup function. This can cause application crashes or instability when processing crafted XML data. The vulnerability requires local access and has high attack complexity, limiting its practical impact. No confidentiality or integrity impacts are reported. The advisory covers multiple related CVEs affecting libxml2 components.

Red Hat has released updated libxml2 RPM packages (version 2.15.4-0.1.hum1) for affected architectures (aarch64, x86_64). Users of Red Hat Hardened Images should apply these updates to remediate the vulnerabilities. The vendor advisory provides detailed instructions and package repositories for obtaining the fixes. No alternative mitigations or workarounds are indicated. Patch status is confirmed as fixed in the updated packages.