CVE-2024-25062

HIGH7.5

An issue was discovered in libxml2 before 2

Published Feb 4, 2024

Modified 4 months ago

Details

An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.

References

WEB

https://gitlab.gnome.org/GNOME/libxml2/-/issues/604

WEB

https://gitlab.gnome.org/GNOME/libxml2/-/tags

WEB

https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html

WEB

https://security.netapp.com/advisory/ntap-20241018-0009/

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2024-25062

CVSS Analysis

CVSS v3.1

7.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

HighA:H

7.5/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Ecosystems

Timeline

PublishedFeb 4, 2024

ModifiedNov 3, 2025