---
id: CVE-2023-39615
title: >-
  Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via
  the xmlSAX2StartElement() function at /libxml2/SAX2.c
summary: >-
  Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via
  the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability
  allows attackers to cause a Denial of Service (DoS) via supplying a crafted
  XML file. N…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cwe:
  - CWE-119
vendor: xmlsoft
product: libxml2
affected:
  - libxml2 = 2.11.0
published: '2023-08-29'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T00:16:36.337'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-39615'
references:
  - url: 'https://gitlab.gnome.org/GNOME/libxml2/-/issues/535'
    label: cve@mitre.org
  - url: 'https://gitlab.gnome.org/GNOME/libxml2/-/issues/535'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-341067.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-556635.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-784301.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00755
epssPercentile: 0.54108
ingestedAt: '2026-10-15T01:08:04.205Z'
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-10-02T13:25:30.978898Z'
---

## Overview

Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input.

## Affected

- `libxml2 = 2.11.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.