What is the CVSS score of CVE-2025-24928?

CVE-2025-24928 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Active Iq Unified Manager are affected by CVE-2025-24928?

Organizations using libxml2 before 2.12.10 and 2.13.x before 2.13.6 face notable risk from CVE-2025-24928, a stack-based buffer overflow vulnerability rated CVSS 7.8.. A patch is available.

How to fix or mitigate CVE-2025-24928?

Within 7 days: Identify all affected systems and apply vendor patches promptly. If patching is delayed, consider network segmentation to limit exposure.

Active Iq Unified Manager CVE-2025-24928

HIGH

Stack-based Buffer Overflow (CWE-121)

2025-02-18 cve@mitre.org

Buffer Overflow Stack Overflow Red Hat Active Iq Unified Manager H300s Firmware H410c Firmware H410s Firmware H500s Firmware H700s Firmware Libxml2 Ontap Solidfire Hci Management Node Suse Hci Compute Node Manageability Software Development Kit

7.8

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 05, 2026 - 14:30 nvd

Patch available

Analysis Generated

Mar 28, 2026 - 18:27 vuln.today

CVE Published

Feb 18, 2025 - 23:15 nvd

HIGH 7.8

DescriptionNVD

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.

AnalysisAI

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. Rated high severity (CVSS 7.8), this vulnerability is no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-121. libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047. Affected products include: Netapp Active Iq Unified Manager, Netapp Manageability Software Development Kit, Netapp Ontap, Netapp Solidfire \& Hci Management Node, Xmlsoft Libxml2. Version information: before 2.12.10.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.