CVE-2026-6653: Xmlsoft LIBXML2

Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days.

Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.

Affected products

• Xmlsoft LIBXML2: from 2.9.11, up to and including 2.11.0

Published 2026-06-22. Last modified 2026-07-14.