Xmlsoft

Vulnerability activity for Xmlsoft: what is being exploited, what was published lately, and when the next patch release is due.

All vendors Open in the dashboard

Last 30 days

CVEs: 0
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Last 90 days

CVEs: 8
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Last 365 days

CVEs: 10
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Exploited now

None of this vendor's CVEs are on CISA's known-exploited list.

Recent

5.6MediumSep 5, 2026Xmlsoft libxml2 SSRFCVE-2026-86144In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).
6.9MediumSep 5, 2026Xmlsoft libxml2 Memory corruptionCVE-2026-86143In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.
6.9MediumSep 5, 2026Xmlsoft libxml2 Memory corruptionCVE-2026-86142In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
2.9LowSep 5, 2026Xmlsoft libxml2 Memory corruptionCVE-2026-86141xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.
8.0HighSep 5, 2026Xmlsoft libxml2 Memory corruptionCVE-2026-86140In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
6.9MediumSep 5, 2026Xmlsoft libxml2 Memory corruptionCVE-2026-86139In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.
6.9MediumSep 5, 2026Xmlsoft libxml2 Memory corruptionCVE-2026-86138In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.
2.9LowSep 5, 2026Xmlsoft libxml2 Memory corruptionCVE-2026-86137In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.
7.8HighJun 29, 2026Xmlsoft libxml2 Memory corruptionCVE-2026-11979libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow internal buffers (command, arg, and argv) during input parsing. This results in memory corruption within the stack frame. Successful exploitation may cause a crash or potentially allow arbitrary code executi
3.7LowJan 15, 2026Xmlsoft libxml2 Denial of serviceCVE-2026-0989A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.
7.5HighJul 10, 2025Xmlsoft libxslt Memory corruptionCVE-2025-7424A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of service or unexpected behavior.1.3% likely
7.5HighJun 12, 2025Xmlsoft libxml2 Memory corruptionCVE-2025-6021A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.1.4% likely
7.8HighMar 14, 2025Xmlsoft libxslt Memory corruptionCVE-2025-24855numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.
7.8HighMar 14, 2025Xmlsoft libxslt Memory corruptionCVE-2024-55549xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes.

See every Xmlsoft entry on the dashboard.

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

GitLab · Nov 12, 2025GitLab Patch Release: 18.5.2, 18.4.4, 18.3.6CVE-2024-55549 CVE-2025-24855

Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.