Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Aug 29, 2023 · NIST NVD

   Detected

   Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input.

2. Oct 15, 2026 · NIST NVD

   Updated

   Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input.

Affected

• cpe xmlsoft/libxml22.11.0

Sources

• CVE.orgVulnerability recordCVE-2023-39615

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2023-39615

  30-day exploitation probability 1.1%

  first.org
• NIST NVDVulnerability recordCVE-2023-39615

  Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the prod

  nvd.nist.gov

References

• Reference · cert-portal.siemens.com
• Reference · cert-portal.siemens.com
• Reference · cert-portal.siemens.com
• Reference · cert-portal.siemens.com
• Exploit · gitlab.gnome.org
• Reference · lists.debian.org