PT-2024-25855

CVE-2024-34394

Published

2024-05-02

Updated

2026-10-03

Description by

CVSS 4.0

9.2

Critical

MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions libxmljs2 (affected versions not specified)

Description The issue is related to a type confusion vulnerability that occurs when parsing a specially crafted XML. This happens when the namespaces() function is invoked on a grand-child of a node that refers to an entity, which in turn invokes XmlNode::get local namespaces(). The vulnerability can lead to denial of service and remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Uriya Yavnieli

Vendors

Affected products

Weakness enumeration

CWE-843: Access of Resource Using Incompatible Type (\'Type Confusion\')

Related identifiers

CVE-2024-34394