CVE-2017-9049: xmlsoft libxml2 Out-of-bounds Read
Vulnerability summary
CVE-2017-9049 is a high (CVSS 7.5) Out-of-bounds Read vulnerability in xmlsoft libxml2. EPSS estimates a 4.63% chance of exploitation in the next 30 days, higher than 91.7% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 9 · Related 6Timeline
- 18-05-2017PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.
CVSS metrics
7 scores · 4 sources · 3 versions- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
4.63%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
No change 0.00 pp
From 4.63% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- libxml2< 2.9.4+dfsg1-3.1
Ubuntu1 product
- libxml2< 2.9.1+dfsg1-3ubuntu4.10 | < 2.9.3+dfsg1-1ubuntu0.3
Xmlsoft1 product
- libxml22.9.4
3 vendors · 3 products
References
12 links
- www.openwall.com/lists/oss-security/2017/05/15/1X Refsource MISCExploitMailing ListPatchThird Party AdvisoryREPORT