A type‑confusion flaw in libxml2 occurs when the library processes an XSD‑validated document that contains an internal entity reference; the resulting error causes the application to crash. The vulnerability is classified as CWE‑843 and can be exploited by supplying a crafted XML file. The crash leads to a denial of service, making the affected system or application unavailable.

The flaw affects multiple Red Hat products, including Red Hat Enterprise Linux versions 6 through 10, Red Hat JBoss Core Services, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. Systems running any of these distributions or containers with libxml2 can be impacted.

The CVSS score is 6.5, indicating moderate severity. The EPSS score is lower than 1%, meaning the likelihood of exploitation is low at this time. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attacker must be able to supply a malicious XSD document to an application that uses libxml2 for XML validation; this likely requires either local access or the ability to remotely feed XML to the target application. Upon successful exploitation, the system experiences a crash leading to a denial of service.