Red Hat Security Advisory: libxml2 security update

CVE-2026-6653 is a use-after-free vulnerability in the libxml2 library that can cause denial of service or potentially allow arbitrary code execution when processing specially crafted XML input. This affects multiple versions of libxml2 distributed with Red Hat Enterprise Linux 9 and Ubuntu. Red Hat has issued official patches to remediate this vulnerability, and Ubuntu has also released updates. The advisory also references a related vulnerability CVE-2026-11979 involving arbitrary code execution via buffer overflow in the xmlcatalog utility. The vulnerability is classified as moderate impact.

Successful exploitation of this use-after-free vulnerability can cause denial of service or potentially arbitrary code execution on affected systems. This could allow an attacker to disrupt services or execute malicious code with the privileges of the affected application. However, no known exploits in the wild have been reported.

Official patches are available from Red Hat and Ubuntu to address this vulnerability. Users should apply the security updates provided by their respective vendors promptly. For Red Hat Enterprise Linux 9, updated libxml2 packages are available as detailed in the Red Hat advisory RHSA-2026:61247. No additional mitigation steps are indicated beyond applying these official fixes.