--- id: CVE-2022-29824 title: >- In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows summary: >- In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, m… severity: medium cvss: 6.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H' cwe: - CWE-190 vendor: xmlsoft product: libxml2 affected: - libxml2 < 2.9.14 - libxslt <= 1.1.35 - fedora = 34 - fedora = 35 - fedora = 36 - debian_linux = 9.0 - debian_linux = 10.0 - debian_linux = 11.0 - active_iq_unified_manager - clustered_data_ontap - clustered_data_ontap_antivirus_connector - manageability_software_development_kit - ontap_select_deploy_administration_utility - smi-s_provider - snapdrive - snapmanager - solidfire_&_hci_management_node - zfs_storage_appliance_kit = 8.8 - h300s_firmware - h500s_firmware - h700s_firmware - h410s_firmware - h410c_firmware patched: - libxml2 2.9.14 published: '2022-05-03' updated: '2026-10-14' sourceUpdated: '2026-10-14T17:17:38.460' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-29824' references: - url: >- http://packetstormsecurity.com/files/167345/libxml2-xmlBufAdd-Heap-Buffer-Overflow.html label: cve@mitre.org - url: >- http://packetstormsecurity.com/files/169825/libxml2-xmlParseNameComplex-Integer-Overflow.html label: cve@mitre.org - url: >- https://gitlab.gnome.org/GNOME/libxml2/-/commit/2554a2408e09f13652049e5ffb0d26196b02ebab label: cve@mitre.org - url: >- https://gitlab.gnome.org/GNOME/libxml2/-/commit/6c283d83eccd940bcde15634ac8c7f100e3caefd label: cve@mitre.org - url: 'https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.9.14' label: cve@mitre.org - url: 'https://gitlab.gnome.org/GNOME/libxslt/-/tags' label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2022/05/msg00023.html' label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FZOBT5Y6Y2QLDDX2HZGMV7MJMWGXORKK/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P3NVZVWFRBXBI3AKZZWUWY6INQQPQVSF/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P5363EDV5VHZ5C77ODA43RYDCPMA7ARM/ label: cve@mitre.org - url: 'https://security.gentoo.org/glsa/202210-03' label: cve@mitre.org - url: 'https://security.netapp.com/advisory/ntap-20220715-0006/' label: cve@mitre.org - url: 'https://www.debian.org/security/2022/dsa-5142' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpujul2022.html' label: cve@mitre.org - url: >- http://packetstormsecurity.com/files/167345/libxml2-xmlBufAdd-Heap-Buffer-Overflow.html label: af854a3a-2127-422b-91ae-364da2661108 - url: >- http://packetstormsecurity.com/files/169825/libxml2-xmlParseNameComplex-Integer-Overflow.html label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://gitlab.gnome.org/GNOME/libxml2/-/commit/2554a2408e09f13652049e5ffb0d26196b02ebab label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://gitlab.gnome.org/GNOME/libxml2/-/commit/6c283d83eccd940bcde15634ac8c7f100e3caefd label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.9.14' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://gitlab.gnome.org/GNOME/libxslt/-/tags' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2022/05/msg00023.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FZOBT5Y6Y2QLDDX2HZGMV7MJMWGXORKK/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P3NVZVWFRBXBI3AKZZWUWY6INQQPQVSF/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P5363EDV5VHZ5C77ODA43RYDCPMA7ARM/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.gentoo.org/glsa/202210-03' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20220715-0006/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.debian.org/security/2022/dsa-5142' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujul2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e tags: - nvd epss: 0.03753 epssPercentile: 0.89709 ingestedAt: '2026-10-14T17:44:53.595Z' --- ## Overview In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well. ## Affected - `libxml2 < 2.9.14` - `libxslt <= 1.1.35` - `fedora = 34` - `fedora = 35` - `fedora = 36` - `debian_linux = 9.0` - `debian_linux = 10.0` - `debian_linux = 11.0` - `active_iq_unified_manager` - `clustered_data_ontap` - `clustered_data_ontap_antivirus_connector` - `manageability_software_development_kit` - `ontap_select_deploy_administration_utility` - `smi-s_provider` - `snapdrive` - `snapmanager` - `solidfire_&_hci_management_node` - `zfs_storage_appliance_kit = 8.8` - `h300s_firmware` - `h500s_firmware` - `h700s_firmware` - `h410s_firmware` - `h410c_firmware` ## Remediation Upgrade past the affected range: - `libxml2 2.9.14`