CVE-2022-29824

CVE-2022-29824

nuget/libxml2

Integer Overflow or Wraparound

In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf) and tree.c (xmlBuffer) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.

All versions before 2.9.14

Unfortunately, there is no solution available yet.

2022-05-10