CVE-2022-29824
In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows.
Published May 3, 2022 · updated Oct 14, 2026 · xmlsoft libxml2
In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.
Timeline
Detection, updates, and resolution for this record.
May 3, 2022 · NIST NVD
Detected
In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.
Oct 14, 2026 · NIST NVD
Updated
In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.
Affected
- cpe debian/debian linux10.0
- cpe debian/debian linux11.0
- cpe debian/debian linux9.0
- cpe fedoraproject/fedora34
- cpe fedoraproject/fedora35
- cpe fedoraproject/fedora36
- cpe netapp/active iq unified managerversion unspecified
- cpe netapp/h300s firmwareversion unspecified
- cpe netapp/h500s firmwareversion unspecified
- cpe oracle/zfs storage appliance kit8.8
- cpe xmlsoft/libxml2version unspecified
- cpe xmlsoft/libxsltversion unspecified
Sources
- CVE.orgCVE-2022-29824
Official CVE identifier
cve.org - NIST NVDCVE-2022-29824
In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software usin
nvd.nist.gov