CVE-2022-29824 - CVE House
Back to Database
Status published Medium CVE-2022-29824

In libxml2 before 2.9.14, several buffer handling functions in buf.c...

Vulnerability Description

In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-29824

Credits & Attribution

No credits recorded in the NVD database.

References

More from xmlsoft

View All →
CVE-2025-32415
In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in...
Low 2.9
CVE-2025-32414
In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory...
Medium 5.6
CVE-2025-27113
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL...
Low 2.9
CVE-2025-24928
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based...
High 7.8
CVE-2025-24855
numbers.c in libxslt before 1.1.43 has a use-after-free because, in...
High 7.8

Affected Vendor

Affected Software

libxml2, libxslt, fedora, debian linux, active iq unified manager, clustered data ontap, clustered data ontap antivirus connector, manageability software development kit, ontap select deploy administration utility, smi-s provider, snapdrive, snapmanager, solidfire \& hci management node, zfs storage appliance kit, h300s firmware, h500s firmware, h700s firmware, h410s firmware, h410c firmware
Vulnerable Versions:
0, 34, 35, 36, 9.0, 10.0, 11.0, 8.8

Timeline

Official Publish: May 3rd, 2022
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.