Stack-based buffer overflow in xmlsoft libxml2
Priority LOW 36CWE-121Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 45 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-121 and the CVSS impact.
Summary
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00385 32nd percentileScored 2026-11-07
Fix Partial libxml2 (xmlsoft): 2.12.10, 2.13.6Red Hat: 26 advisoriesRed Hat: 45 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| xmlsoft | libxml2 | before 2.12.10; 2.13.0 to before 2.13.6 | 2.12.10, 2.13.6 | Patch available | CNA |
- libxml2 Vendorxmlsoft Affected before 2.12.10; 2.13.0 to before 2.13.6 Fixed in 2.12.10, 2.13.6 Patch available CNA
CPE configurations NVD · 17
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:* | 9 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* | before 2.12.10; 2.13.0 to before 2.13.6 | Vulnerable | xmlsoft |
| cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:* Versions 9 Vulnerable ·NetApp
- cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* Versions before 2.12.10; 2.13.0 to before 2.13.6 Vulnerable ·xmlsoft
- cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Show 7 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
- cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
Remediation
- Fix · CNA libxml2 (xmlsoft) Fixed in 2.12.10, 2.13.6
Red Hat 26 advisories
- RHSA-2026:67857 Released 2026-09-28 · Red Hat rating ImportantOpenShift Container Platform 4.15.69 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 rhcos-aarch64-415.92.202609140326-0, rhcos-ppc64le-415.92.202609140326-0, rhcos-s390x-415.92.202609140326-0 +1
- RHSA-2025:9895 Released 2025-06-30 · Red Hat rating ImportantRed Hat Service Interconnect security update
- 9Base-Service-Interconnect-1.4 service-interconnect/skupper-config-sync-rhel9, service-interconnect/skupper-flow-collector-rhel9, service-interconnect/skupper-operator-bundle +3
- RHSA-2025:9278 Released 2025-06-24 · Red Hat rating ImportantOpenShift Container Platform 4.19.1 bug fix and security update
- Red Hat OpenShift Container Platform 4.19 openshift4/aws-karpenter-provider-aws-rhel9, openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9 +47
Show 23 more Red Hat advisories
- RHSA-2025:4005 Released 2025-04-17 · Red Hat rating ImportantUpdated service-interconnect rhel9 container images for 1.8
- Red Hat Service Interconnect 1 service-interconnect/skupper-config-sync-rhel9, service-interconnect/skupper-controller-podman-container-rhel9, service-interconnect/skupper-controller-podman-rhel9 +5
- RHSA-2025:3780 Released 2025-04-17 · Red Hat rating ImportantOpenShift Container Platform 4.13.57 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 rhcos
- RHSA-2025:3775 Released 2025-04-16 · Red Hat rating ImportantOpenShift Container Platform 4.18.9 bug fix and security update
- Red Hat OpenShift Container Platform 4.18 openshift4/azure-kms-encryption-provider-rhel9, openshift4/ose-agent-installer-node-agent-rhel9, openshift4/ose-agent-installer-orchestrator-rhel9 +4
- RHSA-2025:3867 Released 2025-04-14 · Red Hat rating ImportantNetwork Observability 1.8.1 for OpenShift
- Red Hat Openshift Network Observability 1.8.1 registry.redhat.io/network-observability/network-observability-rhel9-operator
- RHSA-2025:3573 Released 2025-04-10 · Red Hat rating ImportantOpenShift Container Platform 4.12.75 packages and security update
- Red Hat OpenShift Container Platform 4.12 openshift4/network-tools-rhel8, openshift4/ose-agent-installer-node-agent-rhel8, openshift4/ose-docker-builder +5
- RHSA-2025:3569 Released 2025-04-09 · Red Hat rating ImportantOpenShift Container Platform 4.14.50 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 openshift4/ose-azure-workload-identity-webhook-rhel8, openshift4/ose-cloud-credential-operator, rhcos
- RHSA-2025:3297 Released 2025-04-03 · Red Hat rating ImportantOpenShift Container Platform 4.17.23 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 rhcos
- RHSA-2025:3301 Released 2025-04-03 · Red Hat rating ImportantOpenShift Container Platform 4.16.38 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 openshift4/ose-agent-installer-api-server-rhel9, openshift4/ose-aws-pod-identity-webhook-rhel9, openshift4/ose-azure-workload-identity-webhook-rhel9 +3
- RHSA-2025:3453 Released 2025-04-02 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.62 security update
- Red Hat JBoss Core Services 2.4.62
- RHSA-2025:3397 Released 2025-03-31 · Red Hat rating ImportantRHOAI 2.16.0 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.16 registry.redhat.io/rhoai/odh-codeflare-operator-rhel8, registry.redhat.io/rhoai/odh-dashboard-rhel8, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8 +13
- RHSA-2025:3368 Released 2025-03-27 · Red Hat rating ImportantRHOAI 2.16.0 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.16 registry.redhat.io/rhoai/odh-codeflare-operator-rhel8, registry.redhat.io/rhoai/odh-dashboard-rhel8, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8 +13
- RHSA-2025:3055 Released 2025-03-26 · Red Hat rating ImportantOpenShift Container Platform 4.15.48 security update
- Red Hat OpenShift Container Platform 4.15 rhcos
- RHSA-2025:2789 Released 2025-03-13 · Red Hat rating ImportantRed Hat build of OpenTelemetry 3.5.0 release
- Red Hat OpenShift distributed tracing 3.5.3 registry.redhat.io/rhosdt/opentelemetry-collector-rhel8, registry.redhat.io/rhosdt/opentelemetry-rhel8-operator, registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8
- RHSA-2025:2686 Released 2025-03-12 · Red Hat rating Importantlibxml2 security update
- Red Hat Enterprise Linux AppStream (v. 8) libxml2-devel-2.9.7-19.el8_10
- Red Hat Enterprise Linux BaseOS (v. 8) libxml2-2.9.7-19.el8_10, python3-libxml2-2.9.7-19.el8_10
- RHSA-2025:2679 Released 2025-03-12 · Red Hat rating Importantlibxml2 security update
- Red Hat Enterprise Linux AppStream (v. 9) libxml2-devel-2.9.13-6.el9_5.2
- Red Hat Enterprise Linux BaseOS (v. 9) libxml2-2.9.13-6.el9_5.2, python3-libxml2-2.9.13-6.el9_5.2
- RHSA-2025:2678 Released 2025-03-12 · Red Hat rating Importantlibxml2 security update
- Red Hat Enterprise Linux AppStream EUS (v.9.4) libxml2-devel-2.9.13-9.el9_4
- Red Hat Enterprise Linux BaseOS EUS (v.9.4) libxml2-2.9.13-9.el9_4, python3-libxml2-2.9.13-9.el9_4
- RHSA-2025:2673 Released 2025-03-12 · Red Hat rating Importantlibxml2 security update
- Red Hat Enterprise Linux Server (v. 7 ELS) libxml2-2.9.1-6.el7_9.9, libxml2-2.9.1-6.el7_9.9.ppc, libxml2-devel-2.9.1-6.el7_9.9 +2
- Red Hat Enterprise Linux Server Optional (v. 7 ELS) libxml2-static-2.9.1-6.el7_9.9, libxml2-static-2.9.1-6.el7_9.9.ppc
- RHSA-2025:2660 Released 2025-03-11 · Red Hat rating Importantlibxml2 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) libxml2-devel-2.9.7-9.el8_4.5
- Red Hat Enterprise Linux AppStream E4S (v.8.4) libxml2-devel-2.9.7-9.el8_4.5
- Red Hat Enterprise Linux AppStream TUS (v.8.4) libxml2-devel-2.9.7-9.el8_4.5
- Red Hat Enterprise Linux BaseOS AUS (v.8.4) libxml2-2.9.7-9.el8_4.5, python3-libxml2-2.9.7-9.el8_4.5
- Red Hat Enterprise Linux BaseOS E4S (v.8.4) libxml2-2.9.7-9.el8_4.5, python3-libxml2-2.9.7-9.el8_4.5
- Red Hat Enterprise Linux BaseOS TUS (v.8.4) libxml2-2.9.7-9.el8_4.5, python3-libxml2-2.9.7-9.el8_4.5
- RHSA-2025:2654 Released 2025-03-11 · Red Hat rating Importantlibxml2 security update
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) libxml2-devel-2.9.7-9.el8_2.1
- Red Hat Enterprise Linux BaseOS AUS (v. 8.2) libxml2-2.9.7-9.el8_2.1, python3-libxml2-2.9.7-9.el8_2.1
- RHSA-2025:2513 Released 2025-03-10 · Red Hat rating Importantlibxml2 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) libxml2-devel-2.9.7-13.el8_6.8
- Red Hat Enterprise Linux AppStream E4S (v.8.6) libxml2-devel-2.9.7-13.el8_6.8
- Red Hat Enterprise Linux AppStream TUS (v.8.6) libxml2-devel-2.9.7-13.el8_6.8
- Red Hat Enterprise Linux BaseOS AUS (v.8.6) libxml2-2.9.7-13.el8_6.8, python3-libxml2-2.9.7-13.el8_6.8
- Red Hat Enterprise Linux BaseOS E4S (v.8.6) libxml2-2.9.7-13.el8_6.8, python3-libxml2-2.9.7-13.el8_6.8
- Red Hat Enterprise Linux BaseOS TUS (v.8.6) libxml2-2.9.7-13.el8_6.8, python3-libxml2-2.9.7-13.el8_6.8
- RHSA-2025:2507 Released 2025-03-10 · Red Hat rating Importantlibxml2 security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) libxml2-devel-2.9.7-16.el8_8.7
- Red Hat Enterprise Linux BaseOS EUS (v.8.8) libxml2-2.9.7-16.el8_8.7, python3-libxml2-2.9.7-16.el8_8.7
- RHSA-2025:2483 Released 2025-03-10 · Red Hat rating Importantlibxml2 security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) libxml2-devel-2.9.13-1.el9_0.4
- Red Hat Enterprise Linux BaseOS E4S (v.9.0) libxml2-2.9.13-1.el9_0.4, python3-libxml2-2.9.13-1.el9_0.4
- RHSA-2025:2482 Released 2025-03-10 · Red Hat rating Importantlibxml2 security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) libxml2-devel-2.9.13-3.el9_2.6
- Red Hat Enterprise Linux BaseOS EUS (v.9.2) libxml2-2.9.13-3.el9_2.6, python3-libxml2-2.9.13-3.el9_2.6
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
xmlsoft libxml2 2.12.10, 2.13.6
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2024-37146 Use after free in xmlsoft libxml2Priority MEDIUM 45
- TI-2025-19983 libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.Priority LOW 35
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| 9Base-Service-Interconnect-1.4 | Fixed | RHSA-2025:9895 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | — |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2025:2686 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2025:2679 |
| Red Hat Enterprise Linux AppStream AUS (v. 8.2) | Fixed | RHSA-2025:2654 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2025:2660 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2025:2513 |
| Red Hat Enterprise Linux AppStream E4S (v.8.4) | Fixed | RHSA-2025:2660 |
| Red Hat Enterprise Linux AppStream E4S (v.8.6) | Fixed | RHSA-2025:2513 |
| Red Hat Enterprise Linux AppStream E4S (v.9.0) | Fixed | RHSA-2025:2483 |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Fixed | RHSA-2025:2507 |
| Red Hat Enterprise Linux AppStream EUS (v.9.2) | Fixed | RHSA-2025:2482 |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Fixed | RHSA-2025:2678 |
| Red Hat Enterprise Linux AppStream TUS (v.8.4) | Fixed | RHSA-2025:2660 |
| Red Hat Enterprise Linux AppStream TUS (v.8.6) | Fixed | RHSA-2025:2513 |
| Red Hat Enterprise Linux BaseOS (v. 10) | Fixed | — |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2025:2686 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2025:2679 |
| Red Hat Enterprise Linux BaseOS AUS (v. 8.2) | Fixed | RHSA-2025:2654 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.4) | Fixed | RHSA-2025:2660 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.6) | Fixed | RHSA-2025:2513 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.4) | Fixed | RHSA-2025:2660 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.6) | Fixed | RHSA-2025:2513 |
| Red Hat Enterprise Linux BaseOS E4S (v.9.0) | Fixed | RHSA-2025:2483 |
| Red Hat Enterprise Linux BaseOS EUS (v.8.8) | Fixed | RHSA-2025:2507 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.2) | Fixed | RHSA-2025:2482 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.4) | Fixed | RHSA-2025:2678 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.4) | Fixed | RHSA-2025:2660 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.6) | Fixed | RHSA-2025:2513 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) | Fixed | — |
| Red Hat Enterprise Linux Server (v. 7 ELS) | Fixed | RHSA-2025:2673 |
| Red Hat Enterprise Linux Server Optional (v. 7 ELS) | Fixed | RHSA-2025:2673 |
| Red Hat JBoss Core Services 2.4.62 | Fixed | RHSA-2025:3453 |
| Red Hat OpenShift AI 2.16 | Fixed | RHSA-2025:3368, RHSA-2025:3397 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2025:3573 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2025:3780 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2025:3569 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2025:3055, RHSA-2026:67857 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2025:3301 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2025:3297 |
| Red Hat OpenShift Container Platform 4.18 | Fixed | RHSA-2025:3775 |
| Red Hat OpenShift Container Platform 4.19 | Fixed | RHSA-2025:9278 |
| Red Hat OpenShift distributed tracing 3.5.3 | Fixed | RHSA-2025:2789 |
| Red Hat Openshift Network Observability 1.8.1 | Fixed | RHSA-2025:3867 |
| Red Hat Service Interconnect 1 | Fixed | RHSA-2025:4005 |
Not affected: 10 products
- Red Hat OpenShift AI 2.16
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.15
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Container Platform 4.18
- Red Hat OpenShift distributed tracing 3.5.3
- Red Hat Openshift Network Observability 1.8.1
Timeline
- 2026-10-02 Threatist record created from CVE-2025-24928
- 2026-10-03 Alias added: GHSA-fgfv-9xqc-v794
- 2026-10-09 Fix available: RHSA-2025:3453 · Red Hat
- 2026-10-09 Fix available: Red Hat JBoss Core Services 2.4.62 · Red Hat
References
More xmlsoft Libxml2 vulnerabilities
- TI-2020-06117 xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. CVSS 3.1HIGH 7.5
- TI-2025-05441 Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2 CVSS 3.1HIGH 7.5
- TI-2024-22792 An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. CVSS 3.1HIGH 7.5
- TI-2017-06514 libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the… CVSS 3.1HIGH 7.5
- TI-2022-19140 An issue was discovered in libxml2 before 2.10.3. CVSS 3.1HIGH 7.5
- TI-2025-23491 Out-of-bounds read in xmlsoft libxml2 CVSS 3.1HIGH 7.5
Sources
- CVE-2025-24928 · CVE Program
- CVE-2025-24928 · NVD
- FIRST EPSS
- GHSA-fgfv-9xqc-v794 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-24928 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences