CVE-2026-76781
Publication date 17 September 2026
Last updated 8 October 2026
Ubuntu priority
Description
A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element lacks its mandatory `catalog` attribute, leading to the application crashing and causing a Denial of Service (DoS).
Notes
charlescochran
The vulnerable nextCatalog dedup loop was added by the upstream fix for CVE-2026-0992, which we backported to every supported release, so all releases are affected.
Patch details
| Package | Patch details |
|---|
Severity score breakdown
CVSS version: CVSS v3.0
Base score
5.5 · Medium
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
Related Ubuntu Security Notices (USN)
- USN-8910-1
- libxml2 vulnerabilities
- 8 October 2026