CVE-2025-24928: Buffer Overflow
Last updated 25 February 2025
Other sources
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.
— Debian
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24928?
CVE-2025-24928 is classified as a high severity vulnerability due to the potential for remote code execution from a stack-based buffer overflow.
How do I fix CVE-2025-24928?
To fix CVE-2025-24928, update libxml2 to version 2.12.10 or 2.13.6 or later.
What versions of libxml2 are affected by CVE-2025-24928?
Versions of libxml2 before 2.12.10 and from 2.13.0 to before 2.13.6 are affected by CVE-2025-24928.
What conditions are required to exploit CVE-2025-24928?
Exploitation of CVE-2025-24928 requires DTD validation to occur for an untrusted document or untrusted DTD.
Is CVE-2025-24928 similar to any other vulnerabilities?
Yes, CVE-2025-24928 is similar to CVE-2017-9047, which also involves a stack-based buffer overflow in libxml2.