8.1

CVE-2022-49043: xmlsoft libxml2 Use After Free

CVSS: 8.1v3.1HighModified
AliasesMGASA-2025-0034SUSE-SU-2025:0300-1SUSE-SU-2025:0303-1
Published 26-01-2025Last modified 03-11-2025
Open JSON

Vulnerability summary

CVE-2022-49043 is a high (CVSS 8.1) Use After Free vulnerability in xmlsoft libxml2. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 17.1% of scored vulnerabilities.

Overall risk
32/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.1/10
010
High · v3.1 (CVE.org)
EPSS score
0.26%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6 · Related 2
DLA-4064-1DSA-5949-1RHSA-2025:2507RHSA-2025:2678USN-7240-1USN-7302-1

Timeline

  1. 26-01-2025
    PublishedVulnerability first disclosed.
  2. 03-11-2025
    Last modifiedVulnerability information updated.

Description

xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.26%

Chance of exploitation in the next 30 days

Percentile

17%

Versus all other CVEs

30-day change

0.00 pp

From 0.26% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.26%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse44 products
  • libxml2-python&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 2.9.14-150400.5.35.1
  • libxml2-python&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 2.9.14-150400.5.35.1
  • libxml2-python&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 2.10.3-150500.5.20.1
  • libxml2-python&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS< 2.10.3-150500.5.20.1
  • libxml2-python&distro=SUSE Linux Enterprise Micro 5.3< 2.9.14-150400.5.35.1
Redhat6 products
  • libxml2< 0:2.9.13-6.el9_5.1 | < 0:2.9.13-3.el9_2.4 | < 0:2.9.7-18.el8_10.2
  • libxml2-debuginfo< 0:2.9.13-6.el9_5.1 | < 0:2.9.13-3.el9_2.4 | < 0:2.9.7-18.el8_10.2
  • libxml2-debugsource< 0:2.9.13-6.el9_5.1 | < 0:2.9.13-3.el9_2.4 | < 0:2.9.7-18.el8_10.2
  • libxml2-devel< 0:2.9.13-6.el9_5.1 | < 0:2.9.13-3.el9_2.4 | < 0:2.9.7-18.el8_10.2
  • python3-libxml2< 0:2.9.13-6.el9_5.1 | < 0:2.9.13-3.el9_2.4 | < 0:2.9.7-18.el8_10.2
Opensuse3 products
  • libxml2-python&distro=openSUSE Leap 15.6< 2.10.3-150500.5.20.1
  • libxml2&distro=openSUSE Leap 15.6< 2.10.3-150500.5.20.1
  • python-libxml2-python&distro=openSUSE Leap 15.6< 2.9.7-150000.3.73.1
Debian1 product
  • libxml2< 2.9.14+dfsg-1.3~deb12u2 | < 2.12.7+dfsg+really2.9.14-0.4
Mageia1 product
  • libxml2< 2.10.4-1.5.mga9
Ubuntu1 product
  • libxml2< 2.9.1+dfsg1-3ubuntu4.13+esm7 | < 2.9.3+dfsg1-1ubuntu0.7+esm7 | < 2.9.4+dfsg1-6.1ubuntu1.9+esm2 | < 2.9.10+dfsg-5ubuntu0.20.04.8 | < 2.9.13+dfsg-1ubuntu0.5 | < 2.9.14+dfsg-1.3ubuntu3.1
Xmlsoft1 product
  • libxml2≥ 2.0.0, < 2.11.0 | < 2.11.0

7 vendors · 57 products

References

28 links
Show all 28 references