Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
https://www.cve.org/CVERecord?id=CVE-2026-1757 これは xmllint 対話シェルなのでだいたいセーフ。(リモートから xmllint コマンド使わせるサービス、あんまりないよね。。) 実質的な最後の脆弱性は CVE-2025-32415 (2025年4月)で対処されてるので、今は良いけど、次脆弱性でたら各自パッチ作らなきゃって状況。
Post summary
The post notes that CVE‑2026‑1757 is considered safe, references a previous patch for a different CVE, but offers no PoC, exploit details, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | xmlsoft | libxml2 | - | - | - |