CVE-2025-24928 — Stack-based Buffer Overflow in Libxml2

CWE-121 — Stack-based Buffer OverflowCWE-1395 — Dependency on Vulnerable Third-Party ComponentCWE-416 — Use After Free14 documents10 sources
Severity
7.7HIGHNVD
CNA7.5GHSA9.8OSV9.8OSV7.5
EPSS
0.2%
top 53.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Xmlsoft Libxml2NokogiriNetapp Ontap
Timeline
PublishedFeb 18
Latest updateJul 15

Description

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 2.5 | Impact: 5.2

Affected Packages4 packages

▶CVEListV5xmlsoft/libxml22.13.0 — 2.13.6+1
▶NVDxmlsoft/libxml22.13.0 — 2.13.6+1
▶Debianxmlsoft/libxml2< 2.9.10+dfsg-6.7+deb11u6+3
▶RubyGemsnokogiri/nokogiri< 1.18.3

Also affects: Ontap 9

🔴Vulnerability Details

7
OSV
Duplicate Advisory: Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171↗2025-02-19
▶
GHSA
Duplicate Advisory: Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171↗2025-02-19
▶
GHSA
GHSA-fgfv-9xqc-v794: libxml2 before 2↗2025-02-19
▶
GHSA
Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171↗2025-02-18
▶
CVEList
CVE-2025-24928: libxml2 before 2↗2025-02-18
▶

📋Vendor Advisories

6
Oracle
Oracle Oracle Communications Applications Risk Matrix: Core (libxml2) — CVE-2025-24928↗2025-07-15
▶
Oracle
Oracle Oracle Communications Risk Matrix: Configuration (libxml2) — CVE-2025-24928↗2025-04-15
▶
Ubuntu
libxml2 vulnerabilities↗2025-02-25
▶
Red Hat
libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2↗2025-02-18
▶
Microsoft
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted D↗2025-02-11
▶
CVE-2025-24928 — Stack-based Buffer Overflow in Libxml2 | cvebase