Use‑after‑free occurs when libxml2 parses the internal subset of XML documents. A malformed XML document that references an entity resolves to a dangling pointer, allowing an attacker to trigger a crash during parsing. The crash causes an unauthenticated, remote denial‑of‑service because the parsing thread exits unexpectedly without restoring the library state. This weakness is labeled CWE‑416 (Use After Free) and CWE‑611 (Improper Restriction of XML External Entity Reference).

GNOME libxml2, versions from 2.9.11 through 2.11.0, inclusive. Any program that depends on these library versions and processes externally supplied XML exposes the described flaw.

The vulnerability has a CVSS score of 7, indicating a high risk of denial of service. The EPSS score is not available, so the current evidence of exploitation probability is unknown, and it is not listed in the CISA KEV catalog. Attackers can exploit this flaw remotely by supplying malicious XML to any service that uses libxml2. An unpatched library will terminate, leading to service disruptions. The risk is elevated for publicly reachable applications that automatically parse XML. For internal or isolated systems, the risk is reduced but present if untrusted XML is ingested.