Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2008-4225

23
FAUCET Score

CVE-2008-4225 describes an integer overflow vulnerability in the xmlBufferResize function of libxml2 version 2.7.2, affecting xmlsoft libxml. This flaw allows remote attackers to trigger a denial of service (infinite loop) by submitting a large XML document. With a CVSS score of 7.8 (High), it is easily exploitable over the network with low complexity and no authentication, leading to a complete loss of availability. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion or media coverage surrounding this vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
2.7.2CPE matchmatch criteria
cpe:2.3:a:xmlsoft:libxml:2.7.2:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 2.0

7.8HIGH

AV:N/AC:L/Au:N/C:N/I:N/A:C

Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Exploitability Score
10.0
Impact Score
6.9
CvssVersion
2.0

Exploit Intelligence

EPSS Score
3.21%
Probability of exploitation in next 30 days
EPSS Percentile
86.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
This CVE's current EPSS score of 0.0321 is in the 76th percentile among its peer group of 51,485 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (5)

debianpatch availablevia nvd_reference
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 2.1Fixed in: libxml2-0:2.4.19-12.ent
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 3Fixed in: libxml2-0:2.5.10-14
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 4Fixed in: libxml2-0:2.6.16-12.6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: libxml2-0:2.6.26-2.1.2.7
View patch

Vendor Advisories (1)

redhatCVE-2008-4225Moderate

libxml2: integer overflow leading to infinite loop in xmlBufferResize

Nov 17, 2008

References

lists.apple.com / archives/security-announce/2009/jun/msg00002.html
lists.apple.com / archives/security-announce/2009/Jun/msg00005.html
admin.fedoraproject.org / updates/libxml2-2.7.2-2.fc10
Patch
admin.fedoraproject.org / updates/libxml2-2.7.2-2.fc9
Patch
bugzilla.redhat.com / show_bug.cgi
secunia.com / advisories/32762
Vendor Advisory
secunia.com / advisories/32764
Patch
secunia.com / advisories/32766
Vendor Advisory
secunia.com / advisories/32773
Vendor Advisory
secunia.com / advisories/32802
Vendor Advisory
secunia.com / advisories/32807
Vendor Advisory
secunia.com / advisories/32811
Vendor Advisory
secunia.com / advisories/32974
secunia.com / advisories/33417
secunia.com / advisories/33746
secunia.com / advisories/33792
secunia.com / advisories/34247
secunia.com / advisories/35379
secunia.com / advisories/36173
secunia.com / advisories/36235
security.gentoo.org / glsa/glsa-200812-06.xml
securitytracker.com / id
slackware.com / security/viewer.php
oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10025
oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6234
oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6415
sunsolve.sun.com / search/document.do
sunsolve.sun.com / search/document.do
sunsolve.sun.com / search/document.do
sunsolve.sun.com / search/document.do
sunsolve.sun.com / search/document.do
support.apple.com / kb/HT3613
support.apple.com / kb/HT3639
support.avaya.com / elmodocs2/security/ASA-2009-002.htm
support.avaya.com / elmodocs2/security/ASA-2009-067.htm
redhat.com / archives/fedora-package-announce/2008-November/msg00472.html
redhat.com / archives/fedora-package-announce/2008-November/msg00513.html
wiki.rpath.com / Advisories:rPSA-2008-0325
debian.org / security/2008/dsa-1666
Patch
mandriva.com / security/advisories
osvdb.org / 49992
redhat.com / support/errata/RHSA-2008-0988.html
securityfocus.com / bid/32331
Patch
ubuntu.com / usn/usn-673-1
vmware.com / security/advisories/VMSA-2009-0001.html
vupen.com / english/advisories/2008/3176
vupen.com / english/advisories/2009/0034
vupen.com / english/advisories/2009/0301
vupen.com / english/advisories/2009/0323
vupen.com / english/advisories/2009/1522
vupen.com / english/advisories/2009/1621