GNOME Vulnerabilities and Affected Products
Vulnerabilities associated with libxml2.
Products
Clear product- GLib10 vulnerabilities
- libsoup5 vulnerabilities
- Gdk-Pixbuf3 vulnerabilities
- GIMP3 vulnerabilities
- libxml23 vulnerabilities
- Evolution Data Server2 vulnerabilities
- libgsf2 vulnerabilities
- Ekiga1 vulnerability
- Epiphany1 vulnerability
- Evolution1 vulnerability
- Fonts Viewer1 vulnerability
- gdkpixbuf1 vulnerability
- gdm1 vulnerability
- GDM31 vulnerability
- glade1 vulnerability
- gnome-remote-desktop1 vulnerability
- gnome-shell1 vulnerability
- gvdb1 vulnerability
- librest1 vulnerability
- libxslt1 vulnerability
- malcontent1 vulnerability
- NetworkManager1 vulnerability
- Pango1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-6653HIGH | libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handlingUse After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling. | CVSS7.0v4.0 | EPSS0.355% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-7425HIGH | Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptrA flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption. CWE-416Jul 10, 2025 | CVSS7.8v3.1 | EPSS0.339% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-49795HIGH | Libxml: null pointer dereference leads to denial of service (dos)A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service. CWE-825Jun 16, 2025 | CVSS7.5v3.1 | EPSS0.475% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |