PT-2025-6723 · Libxml2+13 · Libxml2+13
Published
2024-12-15
·
Updated
2026-05-08
·
CVE-2024-56171
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
libxml2 versions 2.12.10 and earlier, 2.13.x versions prior to 2.13.6
Description
The issue is related to a use-after-free in
xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.Recommendations
For libxml2 versions 2.12.10 and earlier, update to version 2.12.10 or later.
For libxml2 2.13.x versions prior to 2.13.6, update to version 2.13.6 or later.
As a temporary workaround, consider restricting the use of
xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables functions until a patch is available.Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Ibm Aix
Linuxmint
Apple Macos
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Libxml2