CVE-2024-56171

⚠️ high

Summary

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.

CVSS Score

7.8

High

EPSS Score

0.1

Exploit Probability

Published Date

2025-02-18

First Seen: 2026-01-05

📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 69.6% of all 329,456 vulnerabilities in our database.

#100,230

Above average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Feb 19, 2025

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Total

Complete system compromise possible

SSVC data provided by CISA

Last Modified 2025-11-03

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

CWE IDs (Weakness Types)

CWE-416

📦 Affected Products 12

Vendor	Product	Status	Affected Versions
xmlsoft	libxml2	Affected	< 2.12.10
xmlsoft	libxml2	Affected	≥ 2.13.0 < 2.13.6
netapp	active_iq_unified_manager	Affected	v-
netapp	solidfire_\&_hci_management_node	Affected	v-
netapp	manageability_software_development_kit	Affected	v-
netapp	h300s_firmware	Affected	v-
netapp	h410c_firmware	Affected	v-
netapp	h410s_firmware	Affected	v-
netapp	h500s_firmware	Affected	v-
netapp	h700s_firmware	Affected	v-
netapp	hci_compute_node	Affected	v-
netapp	ontap	Affected	v9

🔗 References 11

https://gitlab.gnome.org/GNOME/libxml2/-/issues/828

Issue Tracking

http://seclists.org/fulldisclosure/2025/Apr/10

http://seclists.org/fulldisclosure/2025/Apr/11

http://seclists.org/fulldisclosure/2025/Apr/12

http://seclists.org/fulldisclosure/2025/Apr/13

http://seclists.org/fulldisclosure/2025/Apr/4

http://seclists.org/fulldisclosure/2025/Apr/5

http://seclists.org/fulldisclosure/2025/Apr/8

http://seclists.org/fulldisclosure/2025/Apr/9

https://lists.debian.org/debian-lts-announce/2025/02...

https://security.netapp.com/advisory/ntap-20250328-0...

Third Party Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-6732	🔶 medium	6.5	0.1	A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definit...	2026-04-23
CVE-2026-22052	🔶 medium	4.3	0.0	ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability. Success...	2026-03-05
CVE-2026-22050	🔶 medium	4.3	0.0	ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to 9.17.1P2 with snapshot locking enabled are susceptible to a ...	2026-01-12
CVE-2025-9714	🔶 medium	6.2	0.0	Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to ca...	2025-09-10
CVE-2025-6170	ℹ️ low	2.5	0.0	A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inpu...	2025-06-16
CVE-2025-6021	⚠️ high	7.5	1.7	A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a ...	2025-06-12

These CVEs affect the same products