Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 116

Export CSV
CVE-2026-86137

libxml2: libxml2: Denial of Service via out-of-bounds read in xmlFAParsePosCharGroup

In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.

CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Xmlsoft
Products
Libxml2
CVE-2026-86141

libxml2: libxml2: Denial of Service due to NULL pointer dereference in xmlRegNewParserCtxt

xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.

CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Xmlsoft
Products
Libxml2
CVE-2026-86140

libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements

In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Xmlsoft
Products
Libxml2
CVE-2026-86138

libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.

CVSS 3.1 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Xmlsoft
Products
Libxml2
CVE-2026-86143

libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.

CVSS 3.1 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Xmlsoft
Products
Libxml2
CVE-2026-86144

libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Xmlsoft
Products
Libxml2
CVE-2026-86139

libxml2: libxml2: Integer overflow in xmlURIEscapeStr may lead to arbitrary code execution

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.

CVSS 3.1 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Xmlsoft
Products
Libxml2
CVE-2026-11979

Stack-Based Buffer Overflow in libxml2

libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow internal buffers (command, arg, and argv) during input parsing. This results in memory corruption within the stack frame. Successful exploitation may cause a crash or potentially allow arbitrary code execution in the context of the xmlcatalog process. This issue has been fixed in the commit c2e233fc. NOTE: The maintainers of this project did not agree that this issue is a vulnerability and considered it a bug.

CVSS 4.0 · 1.8 Low EPSS < 1% KEV · Not listed
Vendors
Xmlsoft
Products
Libxml2
CVE-2026-6653

libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling

Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Gnome Xmlsoft
Products
Libxml2 Libxml2
CVE-2025-8732

libxml2 xmlcatalog xmlParseSGMLCatalog recursion

A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all."

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Gnome Ibm Siemens and 1 more
Products
Libxml2 Aix Vios and 3 more
CVE-2025-9714

Stack overflow in libxml2

Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Gnome Xmlsoft
Products
Libxml2 Libxml2
CVE-2008-3281

libxml2 denial of service

libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.

CVSS 3.1 · 6.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Apple Canonical Debian and 4 more
Products
Iphone Os Safari Ubuntu Linux and 9 more
CVE-2008-4409

libxml2: infinite loop when entity is used in entity definition

libxml2 2.7.0 and 2.7.1 does not properly handle "predefined entities definitions" in entities, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash), as demonstrated by use of xmllint on a certain XML document, a different vulnerability than CVE-2003-1564 and CVE-2008-3281.

CVSS 2.0 · 5.0 Medium EPSS 8.5% KEV · Not listed
Vendors
Xmlsoft
Products
Libxml2
CVE-2009-2416

mingw32-libxml2: Pointer use-after-free flaws by parsing Notation and Enumeration attribute types

Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file, as demonstrated by the Codenomicon XML fuzzing framework.

CVSS 3.1 · 6.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Apple Canonical Debian and 8 more
Products
Iphone Os Mac Os X Mac Os X Server and 16 more
CVE-2009-2414

mingw32-libxml2: Stack overflow by parsing root XML element DTD definition

Stack consumption vulnerability in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allows context-dependent attackers to cause a denial of service (application crash) via a large depth of element declarations in a DTD, related to a function recursion, as demonstrated by the Codenomicon XML fuzzing framework.

CVSS 2.0 · 4.3 Medium EPSS 3.1% KEV · Not listed
Vendors
Redhat Xmlsoft
Products
Enterprise Linux Libxml Libxml2
CVE-2008-3529

libxml2: long entity name heap buffer overflow

Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a long XML entity name.

CVSS 2.0 · 10.0 Critical EPSS 23.4% KEV · Not listed
Vendors
Apple Canonical Debian and 2 more
Products
Iphone Os Mac Os X Safari and 4 more
CVE-2004-0110

libxml2 long URL causes SEGV

Buffer overflow in the (1) nanohttp or (2) nanoftp modules in XMLSoft Libxml 2 (Libxml2) 2.6.0 through 2.6.5 allow remote attackers to execute arbitrary code via a long URL.

CVSS 2.0 · 7.5 High EPSS 24.2% KEV · Not listed
Vendors
Redhat Sgi Xmlsoft
Products
Enterprise Linux Linux Propack and 2 more
CVE-2004-0989

libxml2 various overflows

Multiple buffer overflows in libXML 2.6.12 and 2.6.13 (libxml2), and possibly other versions, may allow remote attackers to execute arbitrary code via (1) a long FTP URL that is not properly handled by the xmlNanoFTPScanURL function, (2) a long proxy URL containing FTP data that is not properly handled by the xmlNanoFTPScanProxy function, and other overflows related to manipulation of DNS length values, including (3) xmlNanoFTPConnect, (4) xmlNanoHTTPConnectHost, and (5) xmlNanoHTTPConnectHost.

CVSS 2.0 · 10.0 Critical EPSS 21.7% KEV · Not listed
Vendors
Redhat Trustix Ubuntu and 2 more
Products
Enterprise Linux Fedora Core Secure Linux and 4 more
CVE-2003-1564

libxml2: billion laughs DoS attack

libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, aka the "billion laughs attack."

CVSS 3.1 · 6.5 Medium EPSS 1.6% KEV · Not listed
Vendors
Redhat Xmlsoft
Products
Enterprise Linux Libxml2
CVE-2025-24928

libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Netapp Redhat Xmlsoft
Products
Active Iq Unified Manager H300s H300s Firmware and 25 more