Cyber Resilience

CVE-2026-6732

Memory Safety in Redhat Enterprise Linux 10.0 … 9.0

Public PoCMemory Safety
Published
23 April 2026
Modified
30 June 2026
CVSS Score v3.1 6.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0063 47th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-6732 is a medium-severity Type Confusion (CWE-843) vulnerability in Redhat Enterprise Linux. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 47th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to…

more

a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Type confusion in XML/XSD parsing leads directly to application crash, enabling T1499.004 (Application or System Exploitation) for DoS.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1499.004 Application or System Exploitation Impactconfidence: HIGH
Type confusion in XML processing directly enables application crash for DoS via exploitation.
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-0992Same product: Ibm Aix
CVE-2026-0990Same product: Ibm Aix
CVE-2026-0989Same product: Ibm Aix
CVE-2025-7424Same product: Redhat Enterprise Linux
CVE-2025-6170Same product: Redhat Enterprise Linux
CVE-2025-6021Same product: Redhat Enterprise Linux
CVE-2026-55653Same product: Redhat Enterprise Linux
CVE-2026-6845Same product: Redhat Enterprise Linux
CVE-2026-0966Same product: Redhat Enterprise Linux
CVE-2026-13757Same product: Redhat Enterprise Linux

Affected Assets

xmlsoft
libxml2
2.13.0 — 2.15.3
redhat
hardened images
all versions
redhat
jboss core services
all versions
redhat
openshift container platform
4.0
redhat
enterprise linux
10.0, 6.0, 7.0, 8.0, 9.0
ibm
vios
4.1.2.0 · 4.1.0 — 4.1.1.30
ibm
aix
7.3.4 · 7.2.5 — 7.2.5.12 · 7.3.2 — 7.3.3.3

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-2 Flaw Remediation
  • SI-10 Information Input Validation
Detect
Catch it (NIST detect / respond)
  • SI-7 Software, Firmware, and Information Integrity
Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V1.5.2
  • V3.2.3
  • V15.3.5

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires timely patching of libxml2 to eliminate the type-confusion flaw triggered by crafted XSD entity references.

prevent

Enforces validation and sanitization of XML/XSD input before it reaches the vulnerable libxml2 parser, blocking malicious entity references.

detect

Requires integrity checks on software and processed documents that can detect corruption or crashes resulting from the type-confusion condition.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent type-confusion flaws via safe typing, static analysis, and code review while the control itself addresses many additional weaknesses.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development can detect type-confusion vulnerabilities through fuzzing and static analysis.

prevents

Secure SDLC mandates type-safe design and review that can catch type-confusion flaws.

prevents

Application security requirements can specify strong typing and interface contracts that reduce type confusion.

prevents

Secure architecture principles promote type-safe languages and memory-safety mechanisms that mitigate type confusion.

prevents

Secure coding standards directly forbid unsafe type casts and require static-analysis checks for type confusion.

References