This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-76781 →
UBUNTU-CVE-2026-76781
A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML c...
Original description
The description as published by the source.
A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a nextCatalog element lacks its mandatory catalog attribute, leading to the application crashing and causing a Denial of Service (DoS).
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Ubuntu:Pro:14.04:LTS
libxml2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1+dfsg1-3ubuntu4.13+esm13"}]}]
Ubuntu:Pro:16.04:LTS
libxml2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3+dfsg1-1ubuntu0.7+esm14"}]}]
Ubuntu:Pro:18.04:LTS
libxml2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4+dfsg1-6.1ubuntu1.9+esm9"}]}]
Ubuntu:Pro:20.04:LTS
libxml2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-5ubuntu0.20.04.10+esm6"}]}]
Ubuntu:22.04:LTS
libxml2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.13+dfsg-1ubuntu0.14"}]}]
Ubuntu:24.04:LTS
libxml2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.14+dfsg-1.3ubuntu3.10"}]}]
Ubuntu:26.04:LTS
libxml2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.2+dfsg-0.1ubuntu0.3"}]}]
References
- advisory ubuntu.com
- report ubuntu.com
- report cve.org
- report gitlab.gnome.org