xmlsoft libxml2
15 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-86144 | < 2.15.4 | In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance | HIGH 7.8 | 0.2 % | ||
| CVE-2026-86143 | < 2.15.4 | In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks | HIGH 7.3 | 0.2 % | ||
| CVE-2026-86142 | < 2.15.4 | In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation. | HIGH 7.8 | 0.2 % | ||
| CVE-2026-86141 | < 2.15.4 | xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate | LOW 3.3 | 0.2 % | ||
| CVE-2026-86140 | < 2.15.4 | In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow. | HIGH 8.0 | 0.2 % | ||
| CVE-2026-86139 | < 2.15.4 | In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow. | HIGH 7.8 | 0.2 % | ||
| CVE-2026-86138 | < 2.15.4 | In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow. | HIGH 7.8 | 0.1 % | ||
| CVE-2026-86137 | < 2.15.4 | In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp. | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-11979 | ≤ 2.15.3 | Stack-Based Buffer Overflow in libxml2 | LOW 1.8 | 0.1 % | ||
| CVE-2025-32415 | < 2.13.8 ; 2.14.0 – < 2.14.2 | In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit | HIGH 7.5 | 0.6 % | ||
| CVE-2025-32414 | < 2.13.8 ; 2.14.0 – < 2.14.2 | In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an i | HIGH 7.5 | 0.4 % | ||
| CVE-2025-27113 | < 2.12.10 ; 2.13.0 – < 2.13.6 | libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c. | HIGH 7.5 | 1.1 % | ||
| CVE-2025-24928 | < 2.12.10 ; 2.13.0 – < 2.13.6 | libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD va | HIGH 7.8 | 0.4 % | ||
| CVE-2024-56171 | < 2.12.10 ; 2.13.0 – < 2.13.6 | libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlsc | CRITICAL 9.8 | 1.2 % | ||
| CVE-2022-49043 | 2.0.0 – < 2.11.0 | xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free. | HIGH 8.1 | 0.3 % |