Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-24928
CVE-2025-24928:
Alma Linux vulnerability analysis and mitigation
Overview
A stack-based buffer overflow vulnerability (CVE-2025-24928) was discovered in libxml2, affecting versions before 2.12.10 and 2.13.x before 2.13.6. The vulnerability exists in the xmlSnprintfElements function within valid.c and requires DTD validation of an untrusted document or untrusted DTD to be exploited. This vulnerability is similar to a previous issue tracked as CVE-2017-9047 (NVD).
Technical details
The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the following vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N. The flaw is classified as a Stack-based Buffer Overflow (CWE-121) that specifically affects the xmlSnprintfElements function in the validation component of libxml2 (NVD, Security Online).
Impact
The successful exploitation of this vulnerability could lead to denial of service conditions or potentially arbitrary code execution on affected systems. The high severity rating indicates significant potential impact on the confidentiality and integrity of the system, though availability is not directly affected according to the CVSS scoring (Security Online, Ubuntu Notice).
Mitigation and workarounds
Users are strongly advised to update to libxml2 versions 2.12.10 or 2.13.6, which contain fixes for this vulnerability. Older branches of libxml2 will not receive security updates. Various Linux distributions have released updated packages to address this vulnerability, including Ubuntu which has provided specific version updates for different releases (Ubuntu Notice, OSS Security).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management