Skip to content

Xmlsoft · product

Libxml

7 CVEs

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

likely to be exploited
2

Every one of the 7 is a mark on the map. Named now: 1 to 7, most at risk first.

  1. Buffer overflow in the (1) nanohttp or (2) nanoftp modules in XMLSoft Libxml 2 (Libxml2) 2.6.0 through 2.6.5 allow remote attackers to execute arbitrary code via a long URL.CVE-2004-0110Xmlsoft · 24% likely
  2. Multiple buffer overflows in libXML 2.6.12 and 2.6.13 (libxml2), and possibly other versions, may allow remote attackers to execute arbitrary code via (1) a long FTP URL that is n…CVE-2004-0989Xmlsoft · 22% likely
  3. The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.CVE-2015-1819Xmlsoft · 6.3% likely

    CWE-399

  4. Integer overflow in the xmlSAX2Characters function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (memory corruption) or possibly execute arbitra…CVE-2008-4226Xmlsoft · 4.1% likely

    CWE-399

  5. Integer overflow in the xmlBufferResize function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (infinite loop) via a large XML document.CVE-2008-4225Xmlsoft · 3.2% likely

    CWE-189

  6. Stack consumption vulnerability in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allows context-dependent attackers to cause a denial of service (applicat…CVE-2009-2414Xmlsoft · 3.1% likely

    CWE-119

  7. Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (a…CVE-2009-2416Xmlsoft · CVSS 6.5 · 2.0% likely

    CWE-416

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.