CVE-2026-6653: Hitachi Energy RTU500 libxml2 Use-After-Free

CVE-2026-6653 is a use-after-free in libxml2's xmlParseInternalSubset function, present in the bundled XML-parsing library used by Hitachi Energy RTU500 series remote terminal unit firmware, that lets a remote attacker send crafted XML input to corrupt memory and potentially crash or control the parsing process; NVD's own analysis rates the underlying libxml2 flaw 9.8 critical, while Hitachi Energy's RTU500-specific advisory scores it 8.8 in the context of the device's XML services.

CVE-2026-6653 is a use-after-free (CWE-416) in the xmlParseInternalSubset function of libxml2, the open-source XML parsing library. NVD's description states it affects libxml2 versions 2.9.11 through 2.11.0 and "allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling" (NVD). Hitachi Energy's advisory, republished by CISA as ICSA-26-293-05, ties this same flaw to the RTU500 series CMU firmware's XML-based services, stating: "The XML-based services used in RTU500 has a vulnerability, where a use-after-free vulnerability in the xmlParseInternalSubset function of libxml2 may be triggered by processing specially crafted XML input" (CISA ICS Advisory ICSA-26-293-05).

NVD's own (primary) CVSS v3.1 analysis of the underlying libxml2 CVE scores it 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, no privileges or user interaction required, with high confidentiality, integrity and availability impact (NVD). The Hitachi Energy/CISA advisory, scoring the vulnerability specifically in the RTU500 integration context, instead gives CVSS v3.1 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — the lower score reflects a low-privilege (PR:L) precondition that NVD's generic libxml2 rating does not assume (CISA ICS Advisory ICSA-26-293-05). Because NVD's status for this CVE is "Analyzed" with a published primary score, this page uses NVD's 9.8 as the indexed cvss_score and reports the RTU500-specific 8.8 figure here rather than conflating the two.

The CISA advisory, published 2026-10-20 as "a verbatim republication of Hitachi Energy PSIRT 8DBD000259 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory," lists RTU500 series CMU firmware 12.7.1-12.7.7, 13.5.1-13.5.4, 13.6.1-13.6.3, 13.7.1-13.7.8 and 13.8.1-13.8.2 as affected, with fixes in 12.7.8, 13.7.9 (when available), 13.8.3 and 13.9.1, and credits Hitachi Energy's own internal team with the report (CISA ICS Advisory ICSA-26-293-05).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-26, and FIRST scores the probability of exploitation at 0.00355 (29.055th percentile) as of 2026-10-27 (CISA KEV, FIRST EPSS).

RTU500 operators should apply the vendor's firmware updates for their branch (12.7.8, 13.7.9 when available, 13.8.3 or 13.9.1) and, until patched, restrict network access to the XML-based services consistent with general ICS network-segmentation practice.

• Use-after-free in libxml2's xmlParseInternalSubset function (affecting libxml2 2.9.11-2.11.0) allows a remote attacker to cause denial-of-service via crafted XML with improper entity resolution handling. — NVD
• NVD's own CVSS v3.1 analysis scores the flaw 9.8 critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); Hitachi Energy's RTU500-specific advisory instead scores it 8.8 high (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a low-privilege precondition in the RTU500 context. — NVD
• Affects RTU500 series CMU firmware 12.7.1-12.7.7, 13.5.1-13.5.4, 13.6.1-13.6.3, 13.7.1-13.7.8, 13.8.1-13.8.2; fixed in 12.7.8, 13.7.9 (when available), 13.8.3, 13.9.1; advisory is a verbatim republication of Hitachi Energy PSIRT 8DBD000259. — CISA ICS Advisory ICSA-26-293-05
• Not present in the CISA KEV catalog as of 2026-10-26. — CISA KEV
• EPSS score is 0.00355 (29.055th percentile) as of 2026-10-27. — FIRST EPSS