ZeroDay Findings
Sign inSign up

Findings

CVE-2023-45322

libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails.

Published Oct 6, 2023 · updated Oct 15, 2026 · xmlsoft libxml2

libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail."

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 6, 2023 · NIST NVD

    Detected

    libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail."

  2. Oct 15, 2026 · NIST NVD

    Updated

    libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail."

Affected

  • cpe xmlsoft/libxml2version unspecified

Sources

  • CVE.orgVulnerability recordCVE-2023-45322

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2023-45322

    30-day exploitation probability 1.0%

    first.org
  • NIST NVDVulnerability recordCVE-2023-45322

    libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically ca

    nvd.nist.gov

References