CVE-2024-25062

An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gitlab.gnome.org/GNOME/libxml2/-/issues/604	Exploit Issue Tracking
https://gitlab.gnome.org/GNOME/libxml2/-/tags	Release Notes
https://gitlab.gnome.org/GNOME/libxml2/-/issues/604	Exploit Issue Tracking
https://gitlab.gnome.org/GNOME/libxml2/-/tags	Release Notes
https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html
https://security.netapp.com/advisory/ntap-20241018-0009/

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:xmlsoft:libxml2::::::::
	cpe:2.3:a:xmlsoft:libxml2::::::::

History

03 Nov 2025, 22:16

Type	Values Removed	Values Added
References		() https://security.netapp.com/advisory/ntap-20241018-0009/ -

03 Nov 2025, 21:16

Type	Values Removed	Values Added
References		() https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html -

Information

Published : 2024-02-04 16:15

Updated : 2025-11-03 22:16

NVD link : CVE-2024-25062

Mitre link : CVE-2024-25062

CVE.ORG link : CVE-2024-25062

JSON object : View

Products Affected

xmlsoft

libxml2

CWE

CWE-416

Use After Free

{"id": "CVE-2024-25062", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-02-04T16:15:45.120", "references": [{"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/604", "tags": ["Exploit", "Issue Tracking"], "source": "cve@mitre.org"}, {"url": "https://gitlab.gnome.org/GNOME/libxml2/-/tags", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/604", "tags": ["Exploit", "Issue Tracking"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://gitlab.gnome.org/GNOME/libxml2/-/tags", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.netapp.com/advisory/ntap-20241018-0009/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en libxml2 anterior a 2.11.7 y 2.12.x anterior a 2.12.5. Cuando se utiliza la interfaz del Lector XML con la validaci\u00f3n DTD y la expansi\u00f3n XInclude habilitada, el procesamiento de documentos XML manipulados puede generar un use-after-free de xmlValidatePopElement."}], "lastModified": "2025-11-03T22:16:47.667", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "971ACB1F-3D2E-4CBD-A75C-F58063898438", "versionEndExcluding": "2.11.7"}, {"criteria": "cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D4CEB958-63E0-4939-9520-406AB65425C9", "versionEndExcluding": "2.12.5", "versionStartIncluding": "2.12.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}