CVE-2025-24928
HIGH EPSS 29.4%
Published Feb 18, 20251y ago · Modified Jun 17, 20261w ago
7.7 CVSS 3.1
Published Feb 18, 2025 1y ago
Last Modified Jun 17, 2026 1w ago
Description
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability None
Threat Intelligence
EPSS Exploit Probability
29.4% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-121
Affected Products 18
| Vendor | Product | Version | Range |
|---|---|---|---|
| netapp | active_iq_unified_manager | * | any |
| netapp | manageability_software_development_kit | * | any |
| netapp | ontap | 9 | any |
| netapp | solidfire_\&_hci_management_node | * | any |
| xmlsoft | libxml2 | * | <2.12.10 |
| xmlsoft | libxml2 | * | ≥2.13.0 – <2.13.6 |
| netapp | hci_compute_node | * | any |
| netapp | hci_compute_node | * | any |
| netapp | h410c_firmware | * | any |
| netapp | h410c | * | any |
| netapp | h300s_firmware | * | any |
| netapp | h300s | * | any |
| netapp | h500s_firmware | * | any |
| netapp | h500s | * | any |
| netapp | h700s_firmware | * | any |
| netapp | h700s | * | any |
| netapp | h410s_firmware | * | any |
| netapp | h410s | * | any |
References 4
- gitlab.gnome.org https://gitlab.gnome.org/GNOME/libxml2/-/issues/847
- issues.oss-fuzz.com https://issues.oss-fuzz.com/issues/392687022
- lists.debian.org https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html
- security.netapp.com https://security.netapp.com/advisory/ntap-20250321-0006/
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.