7.5

CVE-2024-34459: xmlsoft libxml2 Heap-based Buffer Overflow

CVSS: 7.5v3.1HighModified
AliasesALPINE-CVE-2024-34459MGASA-2024-0211SUSE-SU-2024:2267-1
Published 13-05-2024Last modified 15-10-2026
Open JSON

Vulnerability summary

CVE-2024-34459 is a high (CVSS 7.5) Heap-based Buffer Overflow vulnerability in xmlsoft libxml2. EPSS estimates a 1.80% chance of exploitation in the next 30 days, higher than 78.1% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
40/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
1.80%
0%100%
Low · -0.50 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 4 · Related 2
DLA-4251-1DSA-5949-1USN-7240-1USN-7302-1

Timeline

  1. 13-05-2024
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

1.80%

Chance of exploitation in the next 30 days

Percentile

78%

Versus all other CVEs

30-day change

-0.50 pp

From 2.30% on 18-09-2026

18-09-202618-10-2026
EPSS score
1.80%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (gitlab.gnome.org)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Suse21 products
  • libxml2-python&distro=SUSE Linux Enterprise Micro 5.3< 2.9.14-150400.5.32.1
  • libxml2-python&distro=SUSE Linux Enterprise Micro 5.4< 2.9.14-150400.5.32.1
  • libxml2-python&distro=SUSE Linux Enterprise Micro 5.5< 2.10.3-150500.5.17.1
  • libxml2-python&distro=SUSE Linux Enterprise Module for Basesystem 15 SP5< 2.10.3-150500.5.17.1
  • libxml2-python&distro=SUSE Linux Enterprise Module for Basesystem 15 SP6< 2.10.3-150500.5.17.1
Opensuse7 products
  • libxml2-python&distro=openSUSE Leap 15.5< 2.10.3-150500.5.17.1
  • libxml2-python&distro=openSUSE Leap 15.6< 2.10.3-150500.5.17.1
  • libxml2&distro=openSUSE Leap 15.5< 2.10.3-150500.5.17.1
  • libxml2&distro=openSUSE Leap 15.6< 2.10.3-150500.5.17.1
  • libxml2&distro=openSUSE Tumbleweed< 2.12.7-1.1
Redhat7 products
  • libxml2< 0:2.9.7-21.el8_10.5 | < 0:2.9.7-9.el8_4.10 | < 0:2.9.7-13.el8_6.14 | < 0:2.9.7-16.el8_8.14 | < 0:2.12.5-10.el10_2.1 | < 0:2.9.13-14.el9_8.1 | < 0:2.9.13-13.el9_4.1 | < 0:2.9.13-3.el9_2.11 | < 0:2.9.13-12.el9_6.2 | < 0:2.12.5-9.el10_0.1
  • libxml2-debuginfo< 0:2.9.7-21.el8_10.5 | < 0:2.9.7-9.el8_4.10 | < 0:2.9.7-13.el8_6.14 | < 0:2.9.7-16.el8_8.14 | < 0:2.12.5-10.el10_2.1 | < 0:2.9.13-14.el9_8.1 | < 0:2.9.13-13.el9_4.1 | < 0:2.9.13-3.el9_2.11 | < 0:2.9.13-12.el9_6.2 | < 0:2.12.5-9.el10_0.1
  • libxml2-debugsource< 0:2.9.7-21.el8_10.5 | < 0:2.9.7-9.el8_4.10 | < 0:2.9.7-13.el8_6.14 | < 0:2.9.7-16.el8_8.14 | < 0:2.12.5-10.el10_2.1 | < 0:2.9.13-14.el9_8.1 | < 0:2.9.13-13.el9_4.1 | < 0:2.9.13-3.el9_2.11 | < 0:2.9.13-12.el9_6.2 | < 0:2.12.5-9.el10_0.1
  • libxml2-devel< 0:2.9.7-21.el8_10.5 | < 0:2.9.7-9.el8_4.10 | < 0:2.9.7-13.el8_6.14 | < 0:2.9.7-16.el8_8.14 | < 0:2.12.5-10.el10_2.1 | < 0:2.9.13-14.el9_8.1 | < 0:2.9.13-13.el9_4.1 | < 0:2.9.13-3.el9_2.11 | < 0:2.9.13-12.el9_6.2 | < 0:2.12.5-9.el10_0.1
  • libxml2-static< 0:2.12.5-10.el10_2.1 | < 0:2.12.5-9.el10_0.1
Alpine1 product
  • libxml2≥ 2.12.0, < 2.11.8-r0 | ≥ 2.12.0, < 2.12.7-r0
Debian1 product
  • libxml2< 2.9.14+dfsg-1.3~deb12u2 | < 2.12.7+dfsg+really2.9.14-0.4
Mageia1 product
  • libxml2< 2.10.4-1.4.mga9
Ubuntu1 product
  • libxml2< 2.9.1+dfsg1-3ubuntu4.13+esm7 | < 2.9.3+dfsg1-1ubuntu0.7+esm7 | < 2.9.4+dfsg1-6.1ubuntu1.9+esm2 | < 2.9.10+dfsg-5ubuntu0.20.04.8 | < 2.9.13+dfsg-1ubuntu0.5 | < 2.9.14+dfsg-1.3ubuntu3.1
Xmlsoft1 product
  • libxml2< 2.11.8 | ≥ 2.12.0, < 2.12.7

8 vendors · 40 products

References

50 links
Show all 50 references