CVE-2024-56171
Published: 18 February 2025
Summary
CVE-2024-56171 is a high-severity Use After Free (CWE-416) vulnerability in Xmlsoft Libxml2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 39.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the use-after-free vulnerability by requiring timely installation of libxml2 patches to versions 2.12.10 or 2.13.6.
Implements memory safeguards such as ASLR and DEP to prevent unauthorized code execution from exploiting the use-after-free in xmlschemas.c.
Validates XML documents and schemas prior to processing to block crafted inputs that trigger the vulnerability during schema validation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in XML schema validation enables memory corruption/RCE via crafted local or remote XML input, directly mapping to privilege escalation and exploitation of applications or client execution.
NVD Description
libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must…
more
be used.
Deeper analysisAI
CVE-2024-56171 is a use-after-free vulnerability (CWE-416) in the libxml2 library, affecting versions before 2.12.10 and 2.13.x before 2.13.6. The flaw resides in the functions xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables within xmlschemas.c. Exploitation occurs when processing crafted XML inputs during schema validation.
A local attacker with no privileges (PR:N) can exploit this vulnerability by supplying a crafted XML document for validation against an XML schema featuring specific identity constraints, or by providing a crafted XML schema. The attack requires high complexity (AC:H) and local access (AV:L) with no user interaction (UI:N). Successful exploitation yields high confidentiality and integrity impacts (C:H/I:H) with no availability impact (A:N) but changed scope (S:C), as reflected in the CVSS v3.1 base score of 7.8.
Advisories recommend upgrading to libxml2 2.12.10 or later in the 2.12 branch, or 2.13.6 or later in the 2.13 branch to mitigate the issue. Further technical details and discussion appear in the libxml2 GitLab issue (https://gitlab.gnome.org/GNOME/libxml2/-/issues/828) and full disclosure postings (http://seclists.org/fulldisclosure/2025/Apr/10, http://seclists.org/fulldisclosure/2025/Apr/11, http://seclists.org/fulldisclosure/2025/Apr/12, http://seclists.org/fulldisclosure/2025/Apr/13).
Details
- CWE(s)