CVE-2021-3518
There's a flaw in libxml2 in versions before 2.9.11.
Published May 18, 2021 · updated Oct 14, 2026 · xmlsoft libxml2
There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 18, 2021 · NIST NVD
Detected
There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.
Oct 14, 2026 · NIST NVD
Updated
There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.
Affected
- cpe debian/debian linux9.0
- cpe fedoraproject/fedora33
- cpe fedoraproject/fedora34
- cpe netapp/active iq unified managerversion unspecified
- cpe netapp/clustered data ontapversion unspecified
- cpe netapp/hci h410c firmwareversion unspecified
- cpe oracle/communications cloud native core network function cloud native environment1.10.0
- cpe redhat/enterprise linux8.0
- cpe redhat/jboss core servicesversion unspecified
- cpe xmlsoft/libxml2version unspecified
Sources
- CVE.orgVulnerability recordCVE-2021-3518
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2021-3518
30-day exploitation probability 21.9%
first.org - NIST NVDVulnerability recordCVE-2021-3518
There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.
nvd.nist.gov