libxml2 SAX Parser Double-Free in DTD Attribute Handling

CVE-2026-74860 is a critical memory safety vulnerability in libxml2's Python bindings that exploits improper memory management in the SAX (Simple API for XML) parser. When processing specially crafted XML documents containing Document Type Definitions (DTDs) with enumerated attribute values, the attributeDecl callback handler attempts to free the same memory region twice, triggering a double-free condition. This vulnerability affects any Python application that uses libxml2's SAX bindings to parse untrusted XML input, including web services, document processors, data parsers, and API gateways. The impact is significant: attackers can reliably crash vulnerable applications with minimal effort, enabling denial of service attacks that disrupt availability and business continuity.

While this CVE lacks direct MITRE ATT&CK mappings, Casky's 754 security skills enable detection of the exploitation patterns through behavioral analysis. Practitioners would leverage skills mapping to Resource Hijacking and Availability-focused attacks, identifying XML parsing anomalies, memory corruption indicators, and process crash patterns. Casky's Claude-powered analysis would correlate suspicious indicators such as: unexpected SAX parser invocation sequences with malformed DTD structures, abnormal memory allocation patterns preceding crashes, and application termination following XML document processing. Security teams using Casky would observe findings flagging untrusted XML input sources, missing input validation controls, and libxml2 version exposure—enabling proactive patching and input sanitization controls before exploitation occurs.