CVE-2025-24928

Public on 2025-02-18
Modified on 2025-02-24
Description

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.

Severity
Important
See what this means
CVSS v3 Base Score
7.8
See breakdown

Affected Packages

Platform Package Release Date Advisory
Amazon Linux 1 libxml2 2025-03-17 ALAS-2025-1965
Amazon Linux 2 - Core libxml2 2025-03-25 ALAS2-2025-2794
Amazon Linux 2023 libxml2 2025-03-26 ALAS2023-2025-896

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 7.8 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
NVD CVSSv3 7.8 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

References

FAQs regarding Amazon Linux ALAS/CVE Severity Red Hat: CVE-2025-24928 Mitre: CVE-2025-24928