CVE-2025-24928

Description

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.

Affected products

Vendor	Product	Affected	Fixed
xmlsoft	libxml2	< 2.12.10, 2.13.0 – < 2.13.6	2.12.10

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	libxml2	2.12.7+dfsg+really2.9.14-0.4	—
Debian 13	libxml2	2.12.7+dfsg+really2.9.14-0.4	—
Debian 12	libxml2	2.9.14+dfsg-1.3~deb12u2	DSA-5949-1
Debian 11	libxml2	2.9.10+dfsg-6.7+deb11u6	DLA-4064-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 24.04 LTS	libxml2	2.9.14+dfsg-1.3ubuntu3.2	USN-7302-1
Ubuntu 22.04 LTS	libxml2	2.9.13+dfsg-1ubuntu0.6	USN-7302-1
Ubuntu 20.04 LTS	libxml2	2.9.10+dfsg-5ubuntu0.20.04.9	USN-7302-1

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 18.04 LTS	libxml2	2.9.4+dfsg1-6.1ubuntu1.9+esm2	USN-7302-1
Ubuntu Pro 16.04 LTS	libxml2	2.9.3+dfsg1-1ubuntu0.7+esm7	USN-7302-1
Ubuntu Pro 14.04 LTS	libxml2	2.9.1+dfsg1-3ubuntu4.13+esm7	USN-7302-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 10	libxml2 +3	2.12.5-5.el10_0	RHBA-2025:6597
RHEL 9	libxml2 +2	2.9.13-6.el9_5.2	RHSA-2025:2679
RHEL 8	libxml2 +2	2.9.7-19.el8_10	RHSA-2025:2686

Show 12 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 9.4 EUS	libxml2 +2	2.9.13-9.el9_4	RHSA-2025:2678
RHEL 9.2 EUS	libxml2 +2	2.9.13-3.el9_2.6	RHSA-2025:2482
RHEL 9.0 E4S	libxml2 +2	2.9.13-1.el9_0.4	RHSA-2025:2483
RHEL 8.8 EUS	libxml2 +2	2.9.7-16.el8_8.7	RHSA-2025:2507
RHEL 8.6 TUS	libxml2 +2	2.9.7-13.el8_6.8	RHSA-2025:2513
RHEL 8.6 E4S	libxml2 +2	2.9.7-13.el8_6.8	RHSA-2025:2513
RHEL 8.6 AUS	libxml2 +2	2.9.7-13.el8_6.8	RHSA-2025:2513
RHEL 8.4 TUS	libxml2 +2	2.9.7-9.el8_4.5	RHSA-2025:2660
RHEL 8.4 E4S	libxml2 +2	2.9.7-9.el8_4.5	RHSA-2025:2660
RHEL 8.4 AUS	libxml2 +2	2.9.7-9.el8_4.5	RHSA-2025:2660
RHEL 8.2 AUS	libxml2 +2	2.9.7-9.el8_2.1	RHSA-2025:2654
RHEL 7 ELS	libxml2 +3	2.9.1-6.el7_9.9	RHSA-2025:2673

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 9	libxml2 +2	2.9.13-6.el9_5.2	ALSA-2025:2679
AlmaLinux 8	libxml2 +2	2.9.7-19.el8_10	ALSA-2025:2686

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 9	libxml2	2.9.13-6.el9_5.2	RLSA-2025:2679
Rocky Linux 8	libxml2	2.9.7-19.el8_10	RLSA-2025:2686

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP6	libxml2 +1	2.10.3-150500.5.23.1	SUSE-SU-2025:0746-1
SLES 15 SP5	libxml2 +1	2.10.3-150500.5.23.1	SUSE-SU-2025:0746-1
SLES 15 SP4	libxml2 +1	2.9.14-150400.5.38.1	SUSE-SU-2025:0748-1
SLES 15 SP3	libxml2 +1	2.9.7-150000.3.76.1	SUSE-SU-2025:0976-1
SLES 12 SP5	libxml2 +1	2.9.4-46.81.1	SUSE-SU-2025:0747-1

Show 17 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES 3	libxml2-python	2.10.3-150500.5.23.1	SUSE-SU-2025:0746-1
SLES for SAP 15 SP5	libxml2 +1	2.10.3-150500.5.23.1	SUSE-SU-2025:0746-1
SLES for SAP 15 SP4	libxml2 +1	2.9.14-150400.5.38.1	SUSE-SU-2025:0748-1
SLES for SAP 15 SP3	libxml2 +1	2.9.7-150000.3.76.1	SUSE-SU-2025:0976-1
SLE Micro 6.1	libxml2	2.11.6-slfo.1.1_2.1	SUSE-SU-2025:20274-1
SLE Micro 6.0	libxml2	2.11.6-5.1	SUSE-SU-2025:20177-1
SLE Micro 5.5	libxml2 +1	2.10.3-150500.5.23.1	SUSE-SU-2025:0746-1
SLE Micro 5.4	libxml2 +1	2.9.14-150400.5.38.1	SUSE-SU-2025:0748-1
SLE Micro 5.3	libxml2 +1	2.9.14-150400.5.38.1	SUSE-SU-2025:0748-1
SLE Micro 5.2	libxml2 +1	2.9.7-150000.3.76.1	SUSE-SU-2025:0976-1
SLE Micro 5.1	libxml2	2.9.7-150000.3.76.1	SUSE-SU-2025:0976-1
SLE HPC 15 SP5	libxml2 +1	2.10.3-150500.5.23.1	SUSE-SU-2025:0746-1
SLE HPC 15 SP4	libxml2 +1	2.9.14-150400.5.38.1	SUSE-SU-2025:0748-1
SLE HPC 15 SP3	libxml2 +1	2.9.7-150000.3.76.1	SUSE-SU-2025:0976-1
SUSE Manager Server 4.3	libxml2 +1	2.9.14-150400.5.38.1	SUSE-SU-2025:0748-1
SUSE Manager Proxy 4.3	libxml2 +1	2.9.14-150400.5.38.1	SUSE-SU-2025:0748-1
SUSE Enterprise Storage 7.1	libxml2 +1	2.9.7-150000.3.76.1	SUSE-SU-2025:0976-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	libxml2	2.13.6-1.1	openSUSE-SU-2025:14830-1
openSUSE Tumbleweed	python-lxml	5.3.2-1.1	openSUSE-SU-2025:14999-1
openSUSE Leap 15.6	libxml2 +1	2.10.3-150500.5.23.1	SUSE-SU-2025:0746-1
openSUSE Leap 15.6	python-libxml2-python	2.9.7-150000.3.76.1	SUSE-SU-2025:0976-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	libxml2	2.13.6-r0	—
Alpine v3.24	qt6-qtwebengine	6.10.0-r1	—
Alpine v3.23	libxml2	2.13.6-r0	—
Alpine v3.23	qt6-qtwebengine	6.10.0-r1	—
Alpine v3.22	libxml2	2.13.6-r0	—
Alpine v3.22	qt6-qtwebengine	6.8.3-r5	—
Alpine v3.21	libxml2	2.13.4-r4	—
Alpine v3.20	libxml2	2.12.7-r1	—

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	libxml2	2.11.8-r1	—
Alpine v3.18	libxml2	2.11.8-r1	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	libxml2 +3	2.10.4-1.amzn2023.0.9	ALAS2023-2025-896
Amazon Linux 2	libxml2 +3	2.9.1-6.amzn2.5.16	ALAS2-2025-2794

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	libxml2	2.11.5-4	—
Azure Linux 2 (CBL-Mariner)	libxml2	2.10.4-6	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 9	libxml2 +2	2.9.13-6.el9_5.2	ELSA-2025-2679
Oracle Linux 8	libxml2 +2	2.9.7-19.el8_10	ELSA-2025-2686
Oracle Linux 7	libxml2 +3	2.9.1-6.0.5.el7_9.6	ELSA-2025-2673

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	openjdk-7-jre	No fix yet	—

Advisories 40

ALSA-2025:2679 Important: libxml2 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2025:2686 Important: libxml2 security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2025:2686 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:2679 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:2678 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:2673 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:2660 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:2654 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:2513 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:2483 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:2507 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:2482 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHBA-2025:6597 Red Hat Bug Fix Advisory: libxml2 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 14, 2026
WID-SEC-2025-1439 Dell Secure Connect Gateway: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Oct 11, 2026
WID-SEC-2025-0403 libxml2: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 27, 2026
WID-SEC-2025-1559 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
WID-SEC-2025-0823 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
USN-7302-1 libxml2 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
SUSE-SU-2025:20274-1 Security update for libxml2 SUSE / openSUSE Security Updates · Mar 23, 2026
SUSE-SU-2025:20177-1 Security update for libxml2 SUSE / openSUSE Security Updates · Mar 23, 2026
DSA-5949-1 libxml2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-4064-1 libxml2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
SUSE-SU-2025:0976-1 Security update for libxml2 SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2025:14999-1 python-lxml-doc-5.3.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2025:14830-1 libxml2-2-2.13.6-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2025:0747-1 Security update for libxml2 SUSE / openSUSE Security Updates · Feb 4, 2026
RLSA-2025:2679 Important: libxml2 security update Rocky Linux Security Advisories · Jul 29, 2025
WID-SEC-2025-1572 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2025
WID-SEC-2025-1560 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2025
RLSA-2025:2686 Important: libxml2 security update Rocky Linux Security Advisories · May 7, 2025
SUSE-SU-2025:0746-1 Security update for libxml2 SUSE / openSUSE Security Updates · May 2, 2025
SUSE-SU-2025:0748-1 Security update for libxml2 SUSE / openSUSE Security Updates · May 2, 2025
WID-SEC-2025-0899 Redmine.org Redmine: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 28, 2025
WID-SEC-2025-0859 Tenable Security Nessus: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2025
NCSC-2025-0124 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Apr 16, 2025
ALAS2023-2025-896 Important: libxml2 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 26, 2025
ALAS2-2025-2794 Important: libxml2 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Mar 25, 2025
ELSA-2025-2673 Important: libxml2 security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Mar 20, 2025
ELSA-2025-2679 Important: libxml2 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Mar 12, 2025
ELSA-2025-2686 Important: libxml2 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Mar 12, 2025

CNA	v3.1	7.8
EUVD	v3.1	7.8

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD v…

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

AlmaLinux

Rocky Linux

SUSE

openSUSE

Alpine

Amazon Linux

Azure Linux

Oracle Linux

Wolfi

Advisories 40

References