CVE-2025-24928
published 2025-02-18CVE-2025-24928: libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur…
PriorityP343high7.7CVSS 3.1
AVLACLPRNUINSUCHIHAN
EPSS
0.38%
29.6th percentile
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libxml2 | < libxml2 2.9.14+dfsg-1.3~deb12u2 (bookworm) | libxml2 2.9.14+dfsg-1.3~deb12u2 (bookworm) |
| msrc | azl3_libxml2_2.11.5-4_on_azure_linux_3.0 | — | — |
| msrc | azl3_libxml2_2.11.5-5_on_azure_linux_3.0 | — | — |
| msrc | cbl2_libxml2_2.10.4-6_on_cbl_mariner_2.0 | — | — |
| netapp | ontap | — | — |
| nokogiri | nokogiri | >= 0 < 1.18.3 | 1.18.3 |
| xmlsoft | libxml2 | < 2.12.10 | 2.12.10 |
| xmlsoft | libxml2 | >= 0 < 2.9.10+dfsg-6.7+deb11u6 | 2.9.10+dfsg-6.7+deb11u6 |
| xmlsoft | libxml2 | >= 0 < 2.9.14+dfsg-1.3~deb12u2 | 2.9.14+dfsg-1.3~deb12u2 |
| xmlsoft | libxml2 | >= 0 < 2.12.7+dfsg+really2.9.14-0.4 | 2.12.7+dfsg+really2.9.14-0.4 |
| xmlsoft | libxml2 | >= 0 < 2.12.7+dfsg+really2.9.14-0.4 | 2.12.7+dfsg+really2.9.14-0.4 |
| xmlsoft | libxml2 | >= 0 < 2.9.10+dfsg-5ubuntu0.20.04.9 | 2.9.10+dfsg-5ubuntu0.20.04.9 |
| xmlsoft | libxml2 | >= 0 < 2.9.13+dfsg-1ubuntu0.6 | 2.9.13+dfsg-1ubuntu0.6 |
| xmlsoft | libxml2 | >= 0 < 2.9.14+dfsg-1.3ubuntu3.2 | 2.9.14+dfsg-1.3ubuntu3.2 |
| xmlsoft | libxml2 | >= 0 < 2.9.1+dfsg1-3ubuntu4.13+esm7 | 2.9.1+dfsg1-3ubuntu4.13+esm7 |
| xmlsoft | libxml2 | >= 0 < 2.9.3+dfsg1-1ubuntu0.7+esm7 | 2.9.3+dfsg1-1ubuntu0.7+esm7 |
| xmlsoft | libxml2 | >= 0 < 2.9.4+dfsg1-6.1ubuntu1.9+esm2 | 2.9.4+dfsg1-6.1ubuntu1.9+esm2 |
| xmlsoft | libxml2 | >= 2.13.0 < 2.13.6 | 2.13.6 |
CVSS provenance
nvdv3.17.7HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
ghsa9.8CRITICAL
osv9.8CRITICAL
vendor_ubuntu8.1HIGH
vendor_msrc7.8HIGH
vendor_oracle7.8HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
libxml2 vulnerabilities
osv·2025-02-25·CVSS 7.8
CVE-2022-49043 [HIGH] libxml2 vulnerabilities
libxml2 vulnerabilities
It was discovered that libxml2 incorrectly handled certain memory
operations. A remote attacker could use this issue to cause libxml2 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and
Ubuntu 18.04 LTS. (CVE-2022-49043)
It was discovered that the libxml2 xmllint tool incorrectly handled
certain memory operations. If a user or automated system were tricked into
running xmllint on a specially crafted xml file, a remote attacker could
cause xmllint to crash, resulting in a denial of service. This issue only
affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.
(CVE-2024-34459)
It was discovered that libxml2 did not properly manage memory. An attacker
could poss
OSV
Duplicate Advisory: Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171
osv·2025-02-19·CVSS 9.8
CVE-2025-24928 [CRITICAL] Duplicate Advisory: Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171
Duplicate Advisory: Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171
# Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-vvfq-8hwr-qm4m. This link is maintained to preserve external references.
# Original Description
## Summary
Nokogiri v1.18.3 upgrades its dependency libxml2 to
[v2.13.6](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.6).
libxml2 v2.13.6 addresses:
- CVE-2025-24928
- described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/847
- CVE-2024-56171
- described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/828
## Impact
### CVE-2025-24928
Stack-buffer overflow is possible when reporting DTD validation
errors if the input contains a long (~3kb) QName prefix.
### CVE-2024-56171
GHSA
Duplicate Advisory: Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171
ghsa·2025-02-19·CVSS 9.8
CVE-2025-24928 [CRITICAL] CWE-1395 Duplicate Advisory: Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171
Duplicate Advisory: Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171
# Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-vvfq-8hwr-qm4m. This link is maintained to preserve external references.
# Original Description
## Summary
Nokogiri v1.18.3 upgrades its dependency libxml2 to
[v2.13.6](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.6).
libxml2 v2.13.6 addresses:
- CVE-2025-24928
- described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/847
- CVE-2024-56171
- described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/828
## Impact
### CVE-2025-24928
Stack-buffer overflow is possible when reporting DTD validation
errors if the input contains a long (~3kb) QName prefix.
### CVE-2024-56171
GHSA
GHSA-fgfv-9xqc-v794: libxml2 before 2
ghsa_unreviewed·2025-02-19·CVSS 7.5
CVE-2025-24928 [HIGH] CWE-121 GHSA-fgfv-9xqc-v794: libxml2 before 2
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.
GHSA
Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171
ghsa·2025-02-18·CVSS 9.8
CVE-2025-24928 [CRITICAL] CWE-121 Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171
Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171
## Summary
Nokogiri v1.18.3 upgrades its dependency libxml2 to [v2.13.6](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.6).
libxml2 v2.13.6 addresses:
- CVE-2025-24928
- described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/847
- CVE-2024-56171
- described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/828
## Impact
### CVE-2025-24928
Stack-buffer overflow is possible when reporting DTD validation errors if the input contains a long (~3kb) QName prefix.
### CVE-2024-56171
Use-after-free is possible during validation against untrusted XML Schemas (.xsd) and, potentially, validation of untrusted documents against trusted Schemas if they make use of `xsd:keyref` in combination
OSV
Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171
osv·2025-02-18·CVSS 9.8
CVE-2025-24928 [CRITICAL] Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171
Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171
## Summary
Nokogiri v1.18.3 upgrades its dependency libxml2 to [v2.13.6](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.6).
libxml2 v2.13.6 addresses:
- CVE-2025-24928
- described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/847
- CVE-2024-56171
- described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/828
## Impact
### CVE-2025-24928
Stack-buffer overflow is possible when reporting DTD validation errors if the input contains a long (~3kb) QName prefix.
### CVE-2024-56171
Use-after-free is possible during validation against untrusted XML Schemas (.xsd) and, potentially, validation of untrusted documents against trusted Schemas if they make use of `xsd:keyref` in combination
OSV
CVE-2025-24928: libxml2 before 2
osv·2025-02-18·CVSS 7.5
CVE-2025-24928 [HIGH] CVE-2025-24928: libxml2 before 2
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.
Oracle
Oracle Oracle Communications Applications Risk Matrix: Core (libxml2) — CVE-2025-24928
vendor_oracle·2025-07-15·CVSS 7.2
CVE-2025-24928 [HIGH] Oracle Oracle Communications Applications Risk Matrix: Core (libxml2) — CVE-2025-24928
Oracle Oracle Communications Applications Risk Matrix: Core (libxml2) vulnerability
CVE: CVE-2025-24928
CVSS: 7.2
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpujul2025 (JUL 2025)
Oracle
Oracle Oracle Communications Risk Matrix: Configuration (libxml2) — CVE-2025-24928
vendor_oracle·2025-04-15·CVSS 7.8
CVE-2025-24928 [HIGH] Oracle Oracle Communications Risk Matrix: Configuration (libxml2) — CVE-2025-24928
Oracle Oracle Communications Risk Matrix: Configuration (libxml2) vulnerability
CVE: CVE-2025-24928
CVSS: 7.8
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpuapr2025 (APR 2025)
Ubuntu
libxml2 vulnerabilities
vendor_ubuntu·2025-02-25·CVSS 8.1
CVE-2022-49043 [HIGH] libxml2 vulnerabilities
Title: libxml2 vulnerabilities
Summary: Several security issues were fixed in libxml2.
It was discovered that libxml2 incorrectly handled certain memory
operations. A remote attacker could use this issue to cause libxml2 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and
Ubuntu 18.04 LTS. (CVE-2022-49043)
It was discovered that the libxml2 xmllint tool incorrectly handled
certain memory operations. If a user or automated system were tricked into
running xmllint on a specially crafted xml file, a remote attacker could
cause xmllint to crash, resulting in a denial of service. This issue only
affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.
(CVE-2024-34459)
It was discovered tha
Red Hat
libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2
vendor_redhat·2025-02-18·CVSS 7.5
CVE-2025-24928 [HIGH] CWE-121 libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2
libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.
A flaw was found in libxml2. This vulnerability allows a stack-based buffer overflow via DTD validation of an untrusted document or untrusted DTD.
Statement: This vulnerability is rated as important because it involves a stack-based buffer overflow in the xmlSnprintfElements function within valid.c. Exploiting this issue requires DTD validation to occur on an untrusted document or untrusted DTD, making it a potential security risk for applications using libxml2 that do not adeq
Microsoft
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted D
vendor_msrc·2025-02-11·CVSS 7.8
CVE-2025-24928 [HIGH] CWE-121 libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted D
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional
Debian
CVE-2025-24928: libxml2 - libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflo...
vendor_debian·2025·CVSS 7.5
CVE-2025-24928 [HIGH] CVE-2025-24928: libxml2 - libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflo...
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.
Scope: local
bookworm: resolved (fixed in 2.9.14+dfsg-1.3~deb12u2)
bullseye: resolved (fixed in 2.9.10+dfsg-6.7+deb11u6)
forky: resolved (fixed in 2.12.7+dfsg+really2.9.14-0.4)
sid: resolved (fixed in 2.12.7+dfsg+really2.9.14-0.4)
trixie: resolved (fixed in 2.12.7+dfsg+really2.9.14-0.4)
No detection rules found.
No public exploits indexed.
2025-02-18
Published