Skip to main content
View

Vulnerability Assessment

Weakness
CWE
CWE-416
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

CVSS score of 7.8 (HIGH). Attack characteristics: local attack vector, high complexity, no privileges required, no user interaction not required. EPSS exploitation probability: 0.08%.
Exploit ScenarioDerived

A local attacker with access to the system could access freed memory to execute arbitrary code or crash the application. No authentication is required to exploit this vulnerability.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 28, 2026

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. Rated high severity (CVSS 7.8), this vulnerability is no authentication required. No vendor patch available.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use smart pointers or garbage-collected languages. Set pointers to NULL after freeing. Enable memory sanitizers.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability is classified as Use After Free (CWE-416), which allows attackers to access freed memory to execute arbitrary code or crash the application. libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used. Affected products include: Xmlsoft Libxml2, Netapp Hci Compute Node, Netapp H410C Firmware, Netapp H300S Firmware, Netapp H500S Firmware. Version information: before 2.12.10.

Know when Libxml2 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH
AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
SUSE HIGH
Red Hat 8.1 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

2
Patch released
Apr 02, 2026 - 20:30 nvd
Patch available
CVE Published
Feb 18, 2025 - 22:15 nvd
HIGH 7.8

DescriptionCVE.org

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.

Executive ViewAI

Why It Matters

Organizations using libxml2 before 2.12.10 and 2.13.x before 2.13.6 face notable risk from CVE-2024-56171, a use-after-free vulnerability rated CVSS 7.8. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and consider compensating controls in the interim.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Enable ASLR and DEP where available; (2) Implement network segmentation; (3) Monitor for exploitation indicators.

Threat Intelligence Overview

EPSS Score
0.1%
Top 76% exploitable
Data Quality
3 sources
Confidence: Low
NVD CVE.org EPSS Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)CVE.org

cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*
cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:*
cpe:2.3:a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:*
cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*

More in Libxml2

View all
CVE-2025-6021 HIGH POC
7.5 Jun 12

Stack-based buffer overflow in libxml2's xmlBuildQName function allows remote unauthenticated attackers to crash affecte
CVE-2016-4658 CRITICAL
9.8 Sep 25

xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS befor
CVE-2016-1762 HIGH POC
8.1 Mar 24

The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer
CVE-2016-1834 HIGH POC
7.8 May 20

Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X b
CVE-2016-1840 HIGH POC
7.8 May 20

Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9
CVE-2017-9047 HIGH POC
7.5 May 18

A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. Rated high severity (CVSS 7.5), this vulnerabil
CVE-2016-4447 HIGH POC
7.5 Jun 09

The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denia
CVE-2017-16932 HIGH
7.5 Nov 23

parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities. Rated high severity (CVSS 7.
CVE-2016-4483 HIGH POC
7.5 Apr 11

The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial

CVE-2013-1969 HIGH POC
7.5 Apr 25

Multiple use-after-free vulnerabilities in libxml2 2.9.0 and possibly other versions might allow context-dependent attac
CVE-2016-1839 MEDIUM POC
5.5 May 20

The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS befo
CVE-2016-1838 MEDIUM POC
5.5 May 20

The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 1

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container bci/kiwi:9.24.43-22.3 Image SLES15-SP5-SAPCAL-Azure Image SLES15-SP5-SAPCAL-EC2 Image SLES15-SP5-SAPCAL-GCE Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Affected
Container bci/php-apache:8.2.26-48.37 Container bci/php-fpm:8.2.26-48.37 Container bci/php:8.2.26-48.32 Container bci/spack:0.23 Container containers/apache-tomcat:10.1.34-openjdk11-62.33 Container containers/apache-tomcat:10.1.34-openjdk17-62.33 Container containers/apache-tomcat:10.1.34-openjdk21-62.33 Container containers/apache-tomcat:9.0.98-openjdk11-62.36 Container containers/apache-tomcat:9.0.98-openjdk17-62.34 Container containers/apache-tomcat:9.0.98-openjdk21-62.34 Container containers/apache-tomcat:9.0.98-openjdk8-62.36 Container containers/lmcache-vllm-openai:0.3.2-1.2 Container containers/open-webui:0 Container containers/pytorch:2.5.0-nvidia-1.2 Container containers/vllm-openai:0.9.1-1.2 Container private-registry/harbor-db:2.12.2-2.16 Container private-registry/harbor-nginx:1.21.5-2.15 Container private-registry/harbor-portal:2.12.2-2.16 Container suse/bind:9-36.5 Container suse/kiosk/firefox-esr:esr Container suse/kiosk/pulseaudio:17 Container suse/kiosk/xorg:21 Container suse/manager/5.0/x86_64/proxy-salt-broker:5.0.4.7.19.1 Container suse/manager/5.0/x86_64/proxy-squid:5.0.4.7.17.1 Container suse/manager/5.0/x86_64/server-migration-14-16:5.0.4.7.14.1 Container suse/mariadb:10.11 Container suse/nginx:1.21-51.35 Container suse/pcp:6 Container suse/postgres:16.8-60.13 Container suse/postgres:17.4-41.12 Container suse/rmt-server:2.21-37.5 Container suse/sle-micro/5.5/toolbox:14.2-3.12.3 Container suse/sle-micro/5.5:2.0.4-5.5.252 Container suse/sle-micro/base-5.5:2.0.4-5.8.148 Container suse/sle-micro/kvm-5.5:2.0.4-3.5.285 Container suse/sle-micro/rt-5.5:2.0.4-4.5.330 Image SLES15-SP5-Azure-3P Image SLES15-SP5-Azure-Basic Image SLES15-SP5-Azure-Standard Image SLES15-SP5-BYOS-Azure Image SLES15-SP5-BYOS-EC2 Image SLES15-SP5-BYOS-GCE Image SLES15-SP5-CHOST-BYOS-Aliyun Image SLES15-SP5-CHOST-BYOS-Azure Image SLES15-SP5-CHOST-BYOS-EC2 Image SLES15-SP5-CHOST-BYOS-GCE Image SLES15-SP5-CHOST-BYOS-GDC Image SLES15-SP5-CHOST-BYOS-SAP-CCloud Image SLES15-SP5-EC2 Image SLES15-SP5-GCE Image SLES15-SP5-HPC-Azure Image SLES15-SP5-HPC-BYOS-Azure Image SLES15-SP5-HPC-BYOS-EC2 Image SLES15-SP5-HPC-BYOS-GCE Image SLES15-SP5-Hardened-BYOS-Azure Image SLES15-SP5-Hardened-BYOS-EC2 Image SLES15-SP5-Hardened-BYOS-GCE Image SLES15-SP6 Image SLES15-SP6-Azure-3P Image SLES15-SP6-Azure-Basic Image SLES15-SP6-Azure-Standard Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-GCE Image SLES15-SP6-HPC Image SLES15-SP6-HPC-Azure Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image ai_15_6 Affected
Container suse/ltss/sle12.5/sles12sp5:8.5.55 Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-Azure-HPC-BYOS Image SLES12-SP5-Azure-HPC-On-Demand Image SLES12-SP5-Azure-Standard-On-Demand Image SLES12-SP5-EC2-BYOS Image SLES12-SP5-EC2-ECS-On-Demand Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-GCE-BYOS Image SLES12-SP5-GCE-On-Demand Affected
Container suse/manager/4.3/proxy-httpd:4.3.14.9.60.30 Image SLES15-SP4-Manager-Proxy-4-3-BYOS Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE Affected
Container suse/manager/4.3/proxy-salt-broker:4.3.14.9.50.32 Container suse/manager/4.3/proxy-squid:4.3.14.9.59.20 Container suse/sle-micro-rancher/5.3:latest Container suse/sle-micro-rancher/5.4:latest Container suse/sle-micro/5.3/toolbox:14.2-6.11.94 Container suse/sle-micro/5.4/toolbox:14.2-5.19.94 Image SLES15-SP4-BYOS Image SLES15-SP4-BYOS-Azure Image SLES15-SP4-BYOS-EC2 Image SLES15-SP4-BYOS-GCE Image SLES15-SP4-CHOST-BYOS Image SLES15-SP4-CHOST-BYOS-Aliyun Image SLES15-SP4-CHOST-BYOS-Azure Image SLES15-SP4-CHOST-BYOS-EC2 Image SLES15-SP4-CHOST-BYOS-GCE Image SLES15-SP4-CHOST-BYOS-SAP-CCloud Image SLES15-SP4-HPC-BYOS Image SLES15-SP4-HPC-BYOS-Azure Image SLES15-SP4-HPC-BYOS-EC2 Image SLES15-SP4-HPC-BYOS-GCE Image SLES15-SP4-HPC-EC2 Image SLES15-SP4-HPC-GCE Image SLES15-SP4-Hardened-BYOS Image SLES15-SP4-Hardened-BYOS-Azure Image SLES15-SP4-Hardened-BYOS-EC2 Image SLES15-SP4-Hardened-BYOS-GCE Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHBA-2025:6597 ADVISORY https://access.redhat.com/errata/RHSA-2025:2482 ADVISORY https://access.redhat.com/errata/RHSA-2025:2483 ADVISORY https://access.redhat.com/errata/RHSA-2025:2507 ADVISORY https://access.redhat.com/errata/RHSA-2025:2513 ADVISORY https://access.redhat.com/errata/RHSA-2025:2654 ADVISORY https://access.redhat.com/errata/RHSA-2025:2660 ADVISORY https://access.redhat.com/errata/RHSA-2025:2673 ADVISORY https://access.redhat.com/errata/RHSA-2025:2678 ADVISORY https://access.redhat.com/errata/RHSA-2025:2679 ADVISORY https://access.redhat.com/errata/RHSA-2025:2686 ADVISORY https://access.redhat.com/errata/RHSA-2025:2701 ADVISORY https://access.redhat.com/errata/RHSA-2025:2789 ADVISORY https://access.redhat.com/errata/RHSA-2025:3055 ADVISORY https://access.redhat.com/errata/RHSA-2025:3059 ADVISORY https://access.redhat.com/errata/RHSA-2025:3066 ADVISORY https://access.redhat.com/errata/RHSA-2025:3301 ADVISORY https://access.redhat.com/errata/RHSA-2025:3368 ADVISORY https://access.redhat.com/errata/RHSA-2025:3397 ADVISORY https://access.redhat.com/errata/RHSA-2025:3453 ADVISORY https://access.redhat.com/errata/RHSA-2025:3569 ADVISORY https://access.redhat.com/errata/RHSA-2025:3573 ADVISORY https://access.redhat.com/errata/RHSA-2025:3867 ADVISORY https://access.redhat.com/errata/RHSA-2025:4005 ADVISORY https://access.redhat.com/errata/RHSA-2025:9895 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0746/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0747/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0748/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0976/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20177/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20274/ REF http://seclists.org/fulldisclosure/2025/Apr/10 REF http://seclists.org/fulldisclosure/2025/Apr/11 REF http://seclists.org/fulldisclosure/2025/Apr/12 REF http://seclists.org/fulldisclosure/2025/Apr/13 REF http://seclists.org/fulldisclosure/2025/Apr/4 REF http://seclists.org/fulldisclosure/2025/Apr/5 REF http://seclists.org/fulldisclosure/2025/Apr/8 REF http://seclists.org/fulldisclosure/2025/Apr/9 REF https://gitlab.gnome.org/GNOME/libxml2/-/issues/828 REF https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html REF https://security.netapp.com/advisory/ntap-20250328-0010/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy