CVE-2025-24928

Name
CVE-2025-24928
Description
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
cve@mitre.org https://gitlab.gnome.org/GNOME/libxml2/-/issues/847
cve@mitre.org https://issues.oss-fuzz.com/issues/392687022
af854a3a-2127-422b-91ae-364da2661108 https://security.netapp.com/advisory/ntap-20250321-0006/

Match rules

CPE URI Source package Min version Max version
libxml2 >= 0 < 2.12.10
libxml2 >= 2.13.0 < 2.13.6

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
libxml2 edge-main 2.13.4-r3 Carlo Landmeter <clandmeter@alpinelinux.org> possibly vulnerable
libxml2 edge-main 2.13.6-r0 Carlo Landmeter <clandmeter@alpinelinux.org> fixed
libxml2 3.21-main 2.13.4-r4 Carlo Landmeter <clandmeter@alpinelinux.org> fixed
libxml2 3.20-main 2.12.7-r1 Carlo Landmeter <clandmeter@alpinelinux.org> fixed
libxml2 3.19-main 2.11.8-r1 Carlo Landmeter <clandmeter@alpinelinux.org> fixed
libxml2 3.18-main 2.11.8-r1 Carlo Landmeter <clandmeter@alpinelinux.org> fixed