---
id: CVE-2024-25062
title: An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5
summary: >-
  An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5.
  When using the XML Reader interface with DTD validation and XInclude expansion
  enabled, processing crafted XML documents can lead to an xmlValidatePopElement
  use-…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-416
vendor: xmlsoft
product: libxml2
affected:
  - libxml2 < 2.11.7
  - 'libxml2 >= 2.12.0, < 2.12.5'
patched:
  - libxml2 2.12.5
published: '2024-02-04'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:17:20.350'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-25062'
references:
  - url: 'https://gitlab.gnome.org/GNOME/libxml2/-/issues/604'
    label: cve@mitre.org
  - url: 'https://gitlab.gnome.org/GNOME/libxml2/-/tags'
    label: cve@mitre.org
  - url: 'https://gitlab.gnome.org/GNOME/libxml2/-/issues/604'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://gitlab.gnome.org/GNOME/libxml2/-/tags'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20241018-0009/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-784301.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-794697.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.01224
epssPercentile: 0.68203
ingestedAt: '2026-10-15T03:30:12.636Z'
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2025-05-09T17:35:33.314239Z'
---

## Overview

An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.

## Affected

- `libxml2 < 2.11.7`
- `libxml2 >= 2.12.0, < 2.12.5`

## Remediation

Upgrade past the affected range:

- `libxml2 2.12.5`