Read the docs
TI-2009-02305 Aliases CVE-2009-2416GHSA-2vw2-h5mp-gfhw

Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and…

Priority LOW 33CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-416 and the CVSS impact.

Summary

Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file, as demonstrated by the Codenomicon XML fuzzing framework.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0196 80th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 33

CPEVersionsRoleVendor
cpe:2.3:a:xmlsoft:libxml:1.8.17:*:*:*:*:*:*:*1.8.17Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.5.10:*:*:*:*:*:*:*2.5.10Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.16:*:*:*:*:*:*:*2.6.16Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.26:*:*:*:*:*:*:*2.6.26Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.27:*:*:*:*:*:*:*2.6.27Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.32:*:*:*:*:*:*:*2.6.32Vulnerablexmlsoft
cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:*10VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:11:*:*:*:*:*:*:*11VulnerableFedoraproject
cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*4.0VulnerableDebian
cpe:2.3:o:redhat:enterprise_linux:3.0:*:*:*:*:*:*:*3.0VulnerableRed Hat
  • cpe:2.3:a:xmlsoft:libxml:1.8.17:*:*:*:*:*:*:* Versions 1.8.17 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.5.10:*:*:*:*:*:*:* Versions 2.5.10 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.16:*:*:*:*:*:*:* Versions 2.6.16 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.26:*:*:*:*:*:*:* Versions 2.6.26 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.27:*:*:*:*:*:*:* Versions 2.6.27 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.32:*:*:*:*:*:*:* Versions 2.6.32 Vulnerable ·xmlsoft
  • cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:* Versions 10 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:11:*:*:*:*:*:*:* Versions 11 Vulnerable ·Fedoraproject
  • cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Debian
  • cpe:2.3:o:redhat:enterprise_linux:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Red Hat
Show 23 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:redhat:enterprise_linux:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*5.0VulnerableRed Hat
cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*6.06VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*8.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*8.10VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*9.04VulnerableCanonical
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*before 2.0.172.43VulnerableGoogle
cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*before 4.0.4VulnerableApple
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*2.0 to before 4.0VulnerableApple
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*before 10.4.11; 10.5.0 to before 10.5.8; 10.6.0 to before 10.6.2VulnerableApple
cpe:2.3:o:apple:mac_os_x_server:*:*:*:*:*:*:*:*before 10.4.11; 10.5.0 to before 10.5.8; 10.6.0 to before 10.6.2VulnerableApple
cpe:2.3:o:opensuse:opensuse:*:*:*:*:*:*:*:*10.3 – 11.1VulnerableopenSUSE
cpe:2.3:o:suse:linux_enterprise:10.0:-:*:*:*:*:*:*10.0VulnerableSUSE
cpe:2.3:o:suse:linux_enterprise:11.0:-:*:*:*:*:*:*11.0VulnerableSUSE
cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*9VulnerableSUSE
cpe:2.3:a:vmware:vcenter_server:4.0:-:*:*:*:*:*:*4.0VulnerableVMware
cpe:2.3:a:vmware:vma:4.0:*:*:*:*:*:*:*4.0VulnerableVMware
cpe:2.3:o:vmware:esx:3.0.3:*:*:*:*:*:*:*3.0.3VulnerableVMware
cpe:2.3:o:vmware:esx:3.5:*:*:*:*:*:*:*3.5VulnerableVMware
cpe:2.3:o:vmware:esx:4.0:*:*:*:*:*:*:*4.0VulnerableVMware
cpe:2.3:o:vmware:esxi:3.5:*:*:*:*:*:*:*3.5VulnerableVMware
cpe:2.3:o:vmware:esxi:4.0:*:*:*:*:*:*:*4.0VulnerableVMware
cpe:2.3:a:sun:openoffice.org:*:*:*:*:*:*:*:*2.0.0 to before 2.4.3; 3.0.0 to before 3.1.1VulnerableSun
  • cpe:2.3:o:redhat:enterprise_linux:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
  • cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:* Versions 6.06 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:* Versions 8.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:* Versions 8.10 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:* Versions 9.04 Vulnerable ·Canonical
  • cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* Versions before 2.0.172.43 Vulnerable ·Google
  • cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* Versions before 4.0.4 Vulnerable ·Apple
  • cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* Versions 2.0 to before 4.0 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* Versions before 10.4.11; 10.5.0 to before 10.5.8; 10.6.0 to before 10.6.2 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:*:*:*:*:*:*:*:* Versions before 10.4.11; 10.5.0 to before 10.5.8; 10.6.0 to before 10.6.2 Vulnerable ·Apple
  • cpe:2.3:o:opensuse:opensuse:*:*:*:*:*:*:*:* Versions 10.3 – 11.1 Vulnerable ·openSUSE
  • cpe:2.3:o:suse:linux_enterprise:10.0:-:*:*:*:*:*:* Versions 10.0 Vulnerable ·SUSE
  • cpe:2.3:o:suse:linux_enterprise:11.0:-:*:*:*:*:*:* Versions 11.0 Vulnerable ·SUSE
  • cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:* Versions 9 Vulnerable ·SUSE
  • cpe:2.3:a:vmware:vcenter_server:4.0:-:*:*:*:*:*:* Versions 4.0 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vma:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·VMware
  • cpe:2.3:o:vmware:esx:3.0.3:*:*:*:*:*:*:* Versions 3.0.3 Vulnerable ·VMware
  • cpe:2.3:o:vmware:esx:3.5:*:*:*:*:*:*:* Versions 3.5 Vulnerable ·VMware
  • cpe:2.3:o:vmware:esx:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:3.5:*:*:*:*:*:*:* Versions 3.5 Vulnerable ·VMware
  • cpe:2.3:o:vmware:esxi:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·VMware
  • cpe:2.3:a:sun:openoffice.org:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.4.3; 3.0.0 to before 3.1.1 Vulnerable ·Sun

Remediation

Red Hat 1 advisory

  • RHSA-2009:1206 Released 2009-08-10 · Red Hat rating Moderate
    libxml and libxml2 security update
    • Red Hat Desktop version 3 libxml-1:1.8.17-9.3, libxml-1:1.8.17-9.3.i386, libxml-devel-1:1.8.17-9.3 +7
    • Red Hat Enterprise Linux (v. 5 server) libxml2-2.6.26-2.1.2.8, libxml2-2.6.26-2.1.2.8.i386, libxml2-2.6.26-2.1.2.8.ia64 +9
    • Red Hat Enterprise Linux AS version 3 libxml-1:1.8.17-9.3, libxml-1:1.8.17-9.3.i386, libxml-1:1.8.17-9.3.ia64 +17
    • Red Hat Enterprise Linux AS version 4 libxml2-2.6.16-12.7, libxml2-2.6.16-12.7.i386, libxml2-2.6.16-12.7.ia64 +9
    • Red Hat Enterprise Linux Desktop (v. 5 client) libxml2-2.6.26-2.1.2.8, libxml2-2.6.26-2.1.2.8.i386, libxml2-python-2.6.26-2.1.2.8 +1
    • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) libxml2-2.6.26-2.1.2.8, libxml2-devel-2.6.26-2.1.2.8, libxml2-devel-2.6.26-2.1.2.8.i386
    • Red Hat Enterprise Linux Desktop version 4 libxml2-2.6.16-12.7, libxml2-2.6.16-12.7.i386, libxml2-devel-2.6.16-12.7 +3
    • Red Hat Enterprise Linux ES version 3 libxml-1:1.8.17-9.3, libxml-1:1.8.17-9.3.i386, libxml-1:1.8.17-9.3.ia64 +12
    • Red Hat Enterprise Linux ES version 4 libxml2-2.6.16-12.7, libxml2-2.6.16-12.7.i386, libxml2-2.6.16-12.7.ia64 +6
    • Red Hat Enterprise Linux WS version 3 libxml-1:1.8.17-9.3, libxml-1:1.8.17-9.3.i386, libxml-1:1.8.17-9.3.ia64 +12
    • Red Hat Enterprise Linux WS version 4 libxml2-2.6.16-12.7, libxml2-2.6.16-12.7.i386, libxml2-2.6.16-12.7.ia64 +6

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Desktop version 3Fixed RHSA-2009:1206
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2009:1206
Red Hat Enterprise Linux AS version 3Fixed RHSA-2009:1206
Red Hat Enterprise Linux AS version 4Fixed RHSA-2009:1206
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2009:1206
Red Hat Enterprise Linux Desktop Workstation (v. 5 client)Fixed RHSA-2009:1206
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2009:1206
Red Hat Enterprise Linux ES version 3Fixed RHSA-2009:1206
Red Hat Enterprise Linux ES version 4Fixed RHSA-2009:1206
Red Hat Enterprise Linux WS version 3Fixed RHSA-2009:1206
Red Hat Enterprise Linux WS version 4Fixed RHSA-2009:1206

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-2416
  2. 2026-10-03 Alias added: GHSA-2vw2-h5mp-gfhw

References

Patch 4

Advisory 13

Other 10

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences