CVE-2025-24928
MediumSummary
In libxml2 before 2.12.10 and 2.13.6, a stack-based buffer overflow exists in xmlSnprintfElements in valid.c. Exploitation requires DTD validation of an untrusted document or untrusted DTD. Similar to CVE-2017-9047.
Risk Assessment
An attacker could crash the application or potentially execute arbitrary code by providing a crafted XML document with DTD.
Recommendation
Update libxml2 to version 2.12.10, 2.13.6, or later.
Other vulnerabilities in libxml2
See all- CVE-2017-16932High
The parser.c file in libxml2 before version 2.9.5 does not prevent infinite recursion in parameter entities.
- CVE-2017-7013High
An issue was discovered in certain Apple products related to the 'libxml2' component. Affects iOS before 10.3.3, macOS before 10.12.6, iCloud before 6.2.2 on Windows, iTunes before 12.6.2 on Windows, tvOS before 10.2.2, and watchOS before 3.2.3.
- CVE-2017-7010High
An issue was discovered in certain Apple products related to the 'libxml2' component. It affects iOS before 10.3.3, macOS before 10.12.6, iCloud before 6.2.2 on Windows, iTunes before 12.6.2 on Windows, and tvOS before 10.2.2.
- CVE-2017-0663High
A remote code execution vulnerability in libxml2 could allow an attacker to execute arbitrary code within the context of an unprivileged process. This issue affects applications using this library on Android.
- CVE-2017-9050High
libxml2 version 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. The issue exists due to an incomplete fix for CVE-2016-1839.
- CVE-2017-9049High
libxml2 version 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash.
- CVE-2017-9048High
libxml2 version 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c may strcat two more characters to the buffer without checking if the size allows it.
- CVE-2017-9047High
A buffer overflow was discovered in the libxml2 library in the xmlSnprintfElementContent function, which can lead to writing data beyond allocated memory. The issue arises when the buffer length check does not account for the updated length after appending the prefix.
- CVE-2016-4483High
The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization.
- CVE-2016-4449High
CVE-2016-4449 describes an XXE vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before version 2.9.4. This vulnerability, when not in validating mode, allows attackers to read arbitrary files or cause denial of service through unspecified vectors.
Original NVD description (English source)
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS