← Vulnerability feed

Vulnerability record · CVE-2017-16931 · published 23 November 2017

CVE-2017-16931: Xmlsoft libxml2 memory buffer overflow vulnerability

Xmlsoft · Libxml2

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.

9.8 CVSS 3.0 Critical EPSS 4.3% · top 9.1% CWE-119 · Memory buffer overflow
9.8CVSS 3.0 base score, v2 7.5
4.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
10References
17 Jun 2026Last modified by NVD

Description

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://xmlsoft.org/news.html Release NotesVendor Advisory
https://bugzilla.gnome.org/show_bug.cgi?id=766956 Permissions Required
https://github.com/GNOME/libxml2/commit/e26630548e7d138d2c560844c43820b6767251e3 PatchThird Party Advisory
https://lists.debian.org/debian-lts-announce/2017/11/msg00041.html
https://www.oracle.com//security-alerts/cpujul2021.html
http://xmlsoft.org/news.html Release NotesVendor Advisory
https://bugzilla.gnome.org/show_bug.cgi?id=766956 Permissions Required
https://github.com/GNOME/libxml2/commit/e26630548e7d138d2c560844c43820b6767251e3 PatchThird Party Advisory
https://lists.debian.org/debian-lts-announce/2017/11/msg00041.html
https://www.oracle.com//security-alerts/cpujul2021.html

Track CVE-2017-16931 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2008-3529Xmlsoft libxml2 memory buffer overflow vulnerabilityHeap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-dependent attackers to cause a …EPSS 23%10.0CVE-2004-0989Xmlsoft libxml vulnerabilityMultiple buffer overflows in libXML 2.6.12 and 2.6.13 (libxml2), and possibly other versions, may allow remote attackers to execute arbitrary code vi…EPSS 22%9.8CVE-2024-56171Xmlsoft libxml2 use after free vulnerabilitylibxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. …EPSS 1.2%9.8CVE-2017-7375Xmlsoft libxml2 xml external entity (xxe) vulnerabilityA flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD valida…EPSS 2.6%9.8CVE-2017-7376Xmlsoft libxml2 memory buffer overflow vulnerabilityBuffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.EPSS 23%9.8CVE-2016-4658Apple iphone os memory buffer overflow vulnerabilityxpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does…EPSS 8.6%9.8CVE-2016-4448Hp icewall federation agent vulnerabilityFormat string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.EPSS 7.0%9.8CVE-2015-8710Xmlsoft libxml2 memory buffer overflow vulnerabilityThe htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a denial of service (out-of-bounds h…EPSS 4.9%

Source: NIST National Vulnerability Database (record CVE-2017-16931), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.