6.5

CVE-2023-45322: xmlsoft libxml2 Use After Free

CVSS: 6.5v3.1MediumModified
AliasesMGASA-2023-0298SUSE-SU-2023:4464-1SUSE-SU-2023:4504-1
Published 06-10-2023Last modified 14-10-2026
Open JSON

Vulnerability summary

CVE-2023-45322 is a medium (CVSS 6.5) Use After Free vulnerability in xmlsoft libxml2. EPSS estimates a 0.97% chance of exploitation in the next 30 days, higher than 61% of scored vulnerabilities.

Overall risk
26/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.97%
0%100%
Low · +0.14 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 2
DLA-4064-1DSA-5949-1CGA-2MQ2-PXQ9-3FQMCGA-GC36-66QV-F6F6

Timeline

  1. 06-10-2023
    PublishedVulnerability first disclosed.
  2. 14-10-2026
    Last modifiedVulnerability information updated.

Description

libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail."

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

0.97%

Chance of exploitation in the next 30 days

Percentile

61%

Versus all other CVEs

30-day change

+0.14 pp

From 0.83% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.97%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse20 products
  • libxml2-python&distro=SUSE Linux Enterprise Micro 5.3< 2.9.14-150400.5.25.1
  • libxml2-python&distro=SUSE Linux Enterprise Micro 5.4< 2.9.14-150400.5.25.1
  • libxml2-python&distro=SUSE Linux Enterprise Micro 5.5< 2.10.3-150500.5.11.1
  • libxml2-python&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4< 2.9.14-150400.5.25.1
  • libxml2-python&distro=SUSE Linux Enterprise Module for Basesystem 15 SP5< 2.10.3-150500.5.11.1
Opensuse11 products
  • libxml2-python&distro=openSUSE Leap 15.4< 2.9.14-150400.5.25.1
  • libxml2-python&distro=openSUSE Leap 15.5< 2.10.3-150500.5.11.1
  • libxml2-python&distro=openSUSE Leap Micro 5.3< 2.9.14-150400.5.25.1
  • libxml2-python&distro=openSUSE Leap Micro 5.4< 2.9.14-150400.5.25.1
  • libxml2&distro=openSUSE Leap 15.4< 2.9.14-150400.5.25.1
Mageia2 products
  • libxml2< 2.9.10-7.9.mga8
  • libxml2< 2.10.4-1.2.mga9
Chainguard1 product
  • libxml2< 2.11.5-r1
Debian1 product
  • libxml2< 2.9.14+dfsg-1.3~deb12u2 | < 2.12.7+dfsg+really2.9.14-1
Wolfi1 product
  • libxml2< 2.11.5-r1
Xmlsoft1 product

7 vendors · 37 products

References

16 links
Show all 16 references