CVE-2025-24928

What it actually does

Stack-based buffer overflow in xmlSnprintfElements within valid.c when performing DTD validation on an untrusted XML document or DTD.

Why it matters to the business

Applications that parse untrusted XML with DTD validation enabled may crash or allow arbitrary code execution, disrupting services that rely on libxml2 for document processing.

How an attack unfolds

An attacker crafts a malicious XML document containing a specially formed DTD and supplies it to an application that invokes DTD validation; this triggers the overflow in xmlSnprintfElements during validation, leading to memory corruption that can be leveraged for code execution.

How to fix it

Upgrade libxml2 to version 2.12.10 or 2.13.6 or later; apply commit 02d577715e1951cf114ca4e9adaf5605156c4f4c; Android devices should receive the SoCVersion update dated 2023-01-05.

How to confirm the fix worked

Verify installed libxml2 version against fixed releases; test parsing of crafted malicious DTD documents to confirm the overflow no longer occurs.

Typical attack path

1. Deliver untrusted XML containing a crafted DTD to the target application
2. Ensure DTD validation is triggered during parsing
3. Trigger stack buffer overflow in xmlSnprintfElements
4. Exploit resulting memory corruption for code execution or denial of service

How to detect it

Review application logs for crashes or segmentation faults during XML parsing that involves DTD validation; inspect inbound XML documents for unusual or oversized DTD constructs.

What your security team should do

• Identify all applications and libraries using vulnerable libxml2 versions and schedule immediate upgrades
• Disable DTD validation for untrusted XML where feasible until patches are applied
• Monitor EPSS and exploit maturity trends for any change in risk posture