EUVD-2026-71833
GHSA-6wmc-mmch-49h7
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Network-facing applications routinely pipe external XML to libxml2; stack overflow enables code execution affecting all three CIA pillars, correcting the A:L understatement.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
AnalysisAI
Stack-based buffer overflow in libxml2 before 2.15.4 exposes applications that perform DTD element validation to potential arbitrary code execution via the xmlSnprintfElements function in valid.c. The function performs unbounded strcat calls into a caller-supplied fixed-size stack buffer when formatting element content model descriptions, with no remaining-capacity check before appending parentheses - allowing a crafted XML document with a sufficiently complex element content model to overflow adjacent stack memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that: (1) the target application links against libxml2 in a version before 2.15.4; and (2) the application invokes DTD element validation - specifically via `xmlValidateDocument`, `xmlValidateDtd`, or by setting the `XML_PARSE_DTDVALID` parser option. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, score 8.0) assigns a local attack vector, which warrants scrutiny: libxml2 is embedded in network-facing applications - web servers, email parsers, API gateways, and browsers - that routinely parse externally-supplied XML without local operator involvement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade libxml2 to version 2.15.4 or later, the first release containing the corrected bounds-checking in `xmlSnprintfElements`; the upstream fix is confirmed at https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems and applications using libxml2 and document their current versions using package managers (rpm, apt, or equivalent) and application dependencies-prioritize web services, APIs, and document processors accepting external XML. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Stack-based buffer overflow in libxml2's xmlBuildQName function allows remote unauthenticated attackers to crash affecte
xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS befor
The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer
Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X b
Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9
A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. Rated high severity (CVSS 7.5), this vulnerabil
The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denia
parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities. Rated high severity (CVSS 7.
The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial
Multiple use-after-free vulnerabilities in libxml2 2.9.0 and possibly other versions might allow context-dependent attac
The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS befo
The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 1
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today