Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-24928: libxml2 may let attackers run code

CVE-2025-24928 · published 1 year ago

Summary

The libxml2 library used in several NetApp management products can overflow memory when processing specially crafted XML files, potentially allowing an attacker to execute code on the server. This happens when untrusted XML documents are validated, which could compromise the confidentiality and integrity of your systems. Update the NetApp software to the latest versions that include libxml2 2.12.10 or later, or apply the vendor's security patches as soon as possible.

What to do

Update java to version 8.0.461.
Update java-min to version 8.0.461.
Update jre to version 8.0.461.
Update libxml2 to version 2.9.14-r20071.
Update rootio-libxml2 to version 2.9.14-r20071.
Update libxml2 to version 2.9.14-r20072.
Update rootio-libxml2 to version 2.9.14-r20072.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	netapp	active_iq_unified_manager	All versions `cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vsphere::`
–	netapp	manageability_software_development_kit	All versions `cpe:2.3:a:netapp:manageability_software_development_kit:-:::::::*`
–	netapp	ontap	9 `cpe:2.3:a:netapp:ontap:9:::::::*`
–	netapp	solidfire_\&_hci_management_node	All versions `cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:::::::*`
–	xmlsoft	libxml2	< 2.12.10 >= 2.13.0, < 2.13.6 `cpe:2.3:a:xmlsoft:libxml2::::::::`
–	netapp	hci_compute_node	All versions `cpe:2.3:o:netapp:hci_compute_node:-:::::::*`
–	netapp	h410c_firmware	All versions `cpe:2.3:o:netapp:h410c_firmware:-:::::::*`
–	netapp	h300s_firmware	All versions `cpe:2.3:o:netapp:h300s_firmware:-:::::::*`
–	netapp	h500s_firmware	All versions `cpe:2.3:o:netapp:h500s_firmware:-:::::::*`
–	netapp	h700s_firmware	All versions `cpe:2.3:o:netapp:h700s_firmware:-:::::::*`
–	netapp	h410s_firmware	All versions `cpe:2.3:o:netapp:h410s_firmware:-:::::::*`
Bitnami	–	java	>= 1.9.0, < 8.0.461 Fix: upgrade to 8.0.461
Bitnami	–	java-min	>= 1.9.0, < 8.0.461 Fix: upgrade to 8.0.461
Bitnami	–	jre	>= 1.9.0, < 8.0.461 Fix: upgrade to 8.0.461
Root:Alpine:3.15	–	libxml2	< 2.9.14-r20071 < 2.9.14-r20072 Fix: upgrade to 2.9.14-r20071
Root:Alpine:3.15	–	rootio-libxml2	< 2.9.14-r20071 < 2.9.14-r20072 Fix: upgrade to 2.9.14-r20071

Original advisory text

CVE-2025-24928 in libxml2 - Patched by Root

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-24928 Vendor Advisory
https://security.netapp.com/advisory/ntap-20250321-0006/ Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24928... Vendor Advisory
https://issues.oss-fuzz.com/issues/392687022 URL
https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html URL
https://gitlab.gnome.org/GNOME/libxml2/-/issues/847 Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-121Stack-based Buffer Overflow

Timeline

Published18 Feb 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-24928 · NVD

BIT-java-min-2025-24928 · OSV

BIT-java-2025-24928 · OSV

ROOT-OS-ALPINE-315-CVE-2025-24928 · OSV

CVE-2025-24928 · OSV

Track software like this

Free during beta