Critical severity · published Jun 22, 2026
CVE-2026-6653
libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
libxml2 · GNOME
2.9.11 before 2.11.0 · source: vendor, NVD
In the news
VulnerabilityHigh
Hitachi Energy RTU500 Product
View CSAF
Summary
Hitachi Energy is aware of vulnerabilities that affect RTU500 product versions listed in this document. These vulnerabilities if exploited can have impact on confidentiality, integrity and availability of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.
The following versions of Hitachi Energy RTU500 Product are affected:
RTU500 series CMU Firmware vers:RTU500_series_CMU_Firmware/>=13.5.1|<=13.5.4, vers:RTU500_series_CMU_Firmware/>=13.6.1|<=13.6.3, vers:RTU500_series_CMU_Firmware/>=13.7.1|<=13.7.8, vers:RTU500_series_CMU_Firmware/>=13.8.1|<=13.8.2, vers:RTU500_series_CMU_Firmware/>=12.7.1|<=12.7.7 (CVE-2026-17539, CVE-2026-28388, CVE-2026-6732, CVE-2026-6653, CVE-2026-6276, CVE-2026-9079, CVE-2026-11856, CVE-2026-8927, CVE-2026-8932, CVE-2026-17539, CVE-2026-28388, CVE-2026-6732, CVE-2026-6653, CVE-2026-6276, CVE-2026-9079, CVE-2026-11856, CVE-2026-8927, CVE-2026-8932, CVE-2026-17539, CVE-2026-28388, CVE-2026-6732, CVE-2026-6653, CVE-2026-6276, CVE-2026-9079, CVE-2026-11856, CVE-2026-8927, CVE-2026-8932, CVE-2026-17539, CVE-2026-28388, CVE-2026-6732, CVE-2026-6653, CVE-2026-6276, CVE-2026-9079, CVE-2026-11856, CVE-2026-8927, CVE-2026-8932, CVE-2026-17539, CVE-2026-28388, CVE-2026-6653)
CVSS
Vendor
Equipment
v3 8.8
Hitachi Energy
RTU500 series CMU Firmware
7 Vulnerabilities
NULL Pointer Dereference, ...
Oct 20, 2026·US-CERT ICS Advisories
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-6653
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-6653
Exploit
https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260
Exploit
https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058
More from libxml2
7.8
CVE-2025-7425
Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr
7.5
CVE-2025-49795
Libxml: null pointer dereference leads to denial of service (dos)