CVE-2022-49043 xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Affecting XML Libraries Published on February 18, 2026 Two new Common Vulnerabilities and Exposures (CVEs) were published on February 18, 2026. CVE-2022-49043 affects libxml2 versions before 2.11.0, introducing a use-after-free vulnerability, while CVE-2024-28757 in libexpat versions up to 2.6.1 allows for XML Entity Expansion attacks when using external parsers. Both vulnerabilities could impact applications relying on these libraries for XML processing. 8 sources 41