Stack-Based Buffer Overflow in libxml2: CVE-2025-24928
Summary
CVE-2025-24928: libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. Affects libxml2 across 2 version ranges.
< 2.11.8-r1
>= 4b637079f26d8f5879ed45eb18cd249cad261951, < 02d577715e1951cf114ca4e9adaf5605156c4f4c
Fixed in 2.11.8-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libxml2 is a widely used XML parsing library that provides a range of functionalities for processing XML documents. It is known for its performance and compliance with standards, making it a critical component in many applications. However, certain versions of libxml2 are vulnerable to a stack-based buffer overflow, which can occur during DTD validation of untrusted documents or DTDs.
Vulnerability Detail
CVE-2025-24928 is a stack-based buffer overflow vulnerability found in libxml2 versions prior to 2.12.10 and 2.13.x before 2.13.6. This vulnerability arises in the xmlSnprintfElements function within valid.c. If an attacker provides an untrusted XML document or DTD, they could exploit this vulnerability to execute arbitrary code, leading to potential data breaches or system compromise. This issue is reminiscent of CVE-2017-9047, indicating a recurring problem in the library's handling of XML validation.
How To Fix
Minimum fixed version
2.11.8-r1
This is the first release that contains the fix.
sudo apk add --upgrade libxml2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using DTD validation for untrusted XML documents. This can be done by disabling DTD processing in your XML parser settings, if applicable.
Conclusion
CVE-2025-24928 represents a significant security risk for applications using vulnerable versions of libxml2. It is crucial for users to update their libraries to the latest secure versions to protect against potential exploits. Additionally, employing workarounds can help mitigate risks until updates are applied.
See every vulnerability recorded for libxml2 →
FAQ
CVE-2025-24928 is a vulnerability in libxml2 that allows for a stack-based buffer overflow during DTD validation of untrusted documents.
libxml2 versions before 2.12.10 and 2.13.x before 2.13.6 are affected by this vulnerability.
Exploitation of this vulnerability can lead to arbitrary code execution, potentially compromising the system and exposing sensitive data.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If immediate updates are not possible, disable DTD validation for untrusted documents as a temporary measure to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for libxml2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
