CVE-2024-56171
CRITICAL EPSS 62.3%
Published Feb 18, 20251y ago · Modified Jun 17, 20261w ago
9.8 CVSS 3.1
Published Feb 18, 2025 1y ago
Last Modified Jun 17, 2026 1w ago
Description
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
62.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-416 Use After Free Memory Safety
Affected Products 18
| Vendor | Product | Version | Range |
|---|---|---|---|
| xmlsoft | libxml2 | * | <2.12.10 |
| xmlsoft | libxml2 | * | ≥2.13.0 – <2.13.6 |
| netapp | hci_compute_node | * | any |
| netapp | hci_compute_node | * | any |
| netapp | h410c_firmware | * | any |
| netapp | h410c | * | any |
| netapp | h300s_firmware | * | any |
| netapp | h300s | * | any |
| netapp | h500s_firmware | * | any |
| netapp | h500s | * | any |
| netapp | h700s_firmware | * | any |
| netapp | h700s | * | any |
| netapp | h410s_firmware | * | any |
| netapp | h410s | * | any |
| netapp | active_iq_unified_manager | * | any |
| netapp | manageability_software_development_kit | * | any |
| netapp | ontap | 9 | any |
| netapp | solidfire_\&_hci_management_node | * | any |
References 11
- seclists.org http://seclists.org/fulldisclosure/2025/Apr/10
- seclists.org http://seclists.org/fulldisclosure/2025/Apr/11
- seclists.org http://seclists.org/fulldisclosure/2025/Apr/12
- seclists.org http://seclists.org/fulldisclosure/2025/Apr/13
- seclists.org http://seclists.org/fulldisclosure/2025/Apr/4
- seclists.org http://seclists.org/fulldisclosure/2025/Apr/5
- seclists.org http://seclists.org/fulldisclosure/2025/Apr/8
- seclists.org http://seclists.org/fulldisclosure/2025/Apr/9
- gitlab.gnome.org https://gitlab.gnome.org/GNOME/libxml2/-/issues/828
- lists.debian.org https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html
- security.netapp.com https://security.netapp.com/advisory/ntap-20250328-0010/
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.