CVE-2026-76781: 
Podman vulnerability analysis and mitigation

CVE-2026-76781 is a NULL pointer dereference vulnerability in libxml2 that allows a local user or attacker supplying a specially crafted XML catalog to crash an application, resulting in a Denial of Service (DoS). The flaw occurs during XML catalog parsing when a nextCatalog element is missing its mandatory catalog attribute, causing xmlParseXMLCatalogOneNode() to return NULL, which is then dereferenced before an existing NULL check in the deduplication loop. Affected products include libxml2 (upstream and Red Hat packages), as well as Red Hat products that bundle it such as podman, container-tools:rhel8/podman, openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9, and swift-lang. The vulnerability was reported on August 19, 2026, and published on September 17, 2026, with a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) in libxml2's XML catalog parsing code. Specifically, xmlParseXMLCatalogOneNode() returns NULL when a nextCatalog element lacks its mandatory catalog attribute, but the nextCatalog deduplication loop dereferences the returned entry before the existing NULL check is reached, causing the application to crash. The attack vector is local (AV:L), requires no privileges, but does require user interaction — an attacker must supply a malicious XML catalog file that is then processed by an application linked against libxml2. The fix is tracked in the libxml2 upstream repository via commit c6324894 and merge request 442 (Red Hat CVE, Red Hat Bugzilla, libxml2 MR).

Successful exploitation causes the affected application to crash, resulting in a Denial of Service. There is no impact on confidentiality or integrity under normal circumstances, as the vulnerability only affects availability. The attack surface is limited to scenarios where an attacker can supply a malicious XML catalog file to an application using libxml2, which constrains the practical risk to environments that process untrusted XML input (Red Hat CVE).

There is no known public proof-of-concept exploit code, no evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.0016 (0.16%), indicating a very low probability of exploitation in the near term. The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as not automatable (Feedly).

1. Craft malicious XML catalog: Create an XML catalog file containing a nextCatalog element that omits the mandatory catalog attribute, e.g.:

<?xml version="1.0"?>
<!DOCTYPE catalog PUBLIC "-//OASIS//DTD XML Catalogs V1.1//EN" "http://www.oasis-open.org/committees/entity/release/1.1/catalog.dtd">
<catalog xmlns="urn:oasis:names:tc:entity:xmlns:xml:catalog">
  <nextCatalog/>
</catalog>

2. Deliver the file: Provide the crafted catalog file to a target user or application that processes XML catalogs using libxml2 (e.g., via email attachment, shared filesystem, or as input to a vulnerable service).
3. Trigger parsing: Cause the target application to load and parse the malicious catalog file. This may occur automatically if the application resolves XML entities or catalogs from a user-controlled path.
4. Achieve DoS: The application dereferences the NULL pointer returned by xmlParseXMLCatalogOneNode(), causing a crash and denial of service (Red Hat CVE, Red Hat Bugzilla).

• Logs: Application crash logs or core dumps referencing libxml2 catalog parsing functions (e.g., xmlParseXMLCatalogOneNode, xmlParseCatalogFile) with segmentation fault or NULL pointer dereference signals.
• Process: Unexpected termination (SIGSEGV) of applications linked against libxml2 when processing XML files from untrusted sources.
• File System: Presence of unusual or externally supplied XML catalog files (.xml or .cat) in directories monitored by libxml2-linked applications, particularly those containing <nextCatalog> elements without a catalog attribute.

Red Hat has released a patched version of libxml2 (2.15.3-0.1.3.hum1) for Red Hat Hardened Images via security advisory RHSA-2026:57604, issued August 20, 2026. The upstream fix is available in the libxml2 repository via commit c6324894. As a workaround, Red Hat recommends avoiding processing untrusted XML catalog files with libxml2-linked applications, restricting applications from loading external XML catalogs, and ensuring only trusted catalog files are used (Red Hat Advisory, Red Hat CVE, libxml2 Commit).

Red Hat credited Yirou Yang for discovering and reporting this vulnerability. The issue has been classified as Moderate severity by Red Hat, with the assessment that the attack surface is limited due to the requirement for user interaction and local access. No notable broader community or media coverage has been identified beyond standard vulnerability database entries (Red Hat CVE).