CVE-2021-3516
There's a flaw in libxml2's xmllint in versions before 2.9.11.
Published Jun 1, 2021 · updated Oct 14, 2026 · xmlsoft xmllint
There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Jun 1, 2021 · NIST NVD
Detected
There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability.
Oct 14, 2026 · NIST NVD
Updated
There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability.
Affected
- cpe debian/debian linux9.0
- cpe fedoraproject/fedora33
- cpe fedoraproject/fedora34
- cpe netapp/clustered data ontapversion unspecified
- cpe oracle/zfs storage appliance kit8.8
- cpe redhat/enterprise linux6.0
- cpe redhat/enterprise linux7.0
- cpe redhat/enterprise linux8.0
- cpe redhat/jboss core servicesversion unspecified
- cpe xmlsoft/xmllintversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2021-3516
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2021-3516
30-day exploitation probability 2.0%
first.org - NIST NVDVulnerability recordCVE-2021-3516
There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability.
nvd.nist.gov