Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2008-4226

28
FAUCET Score

CVE-2008-4226 describes an integer overflow in the xmlSAX2Characters function of libxml2 version 2.7.2, affecting xmlsoft libxml. This critical vulnerability, with a CVSS score of 10.0, allows unauthenticated remote attackers to cause a denial of service through memory corruption or potentially execute arbitrary code by supplying a large XML document. Despite its high severity and FAUCET Risk Score of 84/100, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
2.7.2CPE matchmatch criteria
cpe:2.3:a:xmlsoft:libxml:2.7.2:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 2.0

10.0HIGH

AV:N/AC:L/Au:N/C:C/I:C/A:C

Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Exploitability Score
10.0
Impact Score
10.0
CvssVersion
2.0

Exploit Intelligence

EPSS Score
4.05%
Probability of exploitation in next 30 days
EPSS Percentile
89.6%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
This CVE's current EPSS score of 0.0405 is in the 82nd percentile among its peer group of 51,485 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (5)

debianpatch availablevia nvd_reference
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 2.1Fixed in: libxml2-0:2.4.19-12.ent
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 3Fixed in: libxml2-0:2.5.10-14
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 4Fixed in: libxml2-0:2.6.16-12.6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: libxml2-0:2.6.26-2.1.2.7
View patch

Vendor Advisories (1)

redhatCVE-2008-4226Important

libxml2: integer overflow leading to memory corruption in xmlSAX2Characters

Nov 17, 2008

References

h20000.www2.hp.com / bizsupport/TechSupport/Document.jsp
lists.apple.com / archives/security-announce/2009/jun/msg00002.html
lists.apple.com / archives/security-announce/2009/Jun/msg00005.html
lists.opensuse.org / opensuse-security-announce/2008-11/msg00002.html
admin.fedoraproject.org / updates/libxml2-2.7.2-2.fc10
Patch
admin.fedoraproject.org / updates/libxml2-2.7.2-2.fc9
Patch
bugzilla.redhat.com / show_bug.cgi
secunia.com / advisories/32762
Vendor Advisory
secunia.com / advisories/32764
Vendor Advisory
secunia.com / advisories/32766
Vendor Advisory
secunia.com / advisories/32773
Vendor Advisory
secunia.com / advisories/32802
Vendor Advisory
secunia.com / advisories/32807
Vendor Advisory
secunia.com / advisories/32811
Vendor Advisory
secunia.com / advisories/32872
secunia.com / advisories/32974
secunia.com / advisories/33417
secunia.com / advisories/33746
secunia.com / advisories/33792
secunia.com / advisories/34247
secunia.com / advisories/35379
secunia.com / advisories/36173
secunia.com / advisories/36235
security.gentoo.org / glsa/glsa-200812-06.xml
securitytracker.com / id
slackware.com / security/viewer.php
oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6219
oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6360
oval.cisecurity.org / repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9888
sunsolve.sun.com / search/document.do
sunsolve.sun.com / search/document.do
sunsolve.sun.com / search/document.do
sunsolve.sun.com / search/document.do
sunsolve.sun.com / search/document.do
support.apple.com / kb/HT3613
support.apple.com / kb/HT3639
support.avaya.com / elmodocs2/security/ASA-2009-002.htm
support.avaya.com / elmodocs2/security/ASA-2009-067.htm
redhat.com / archives/fedora-package-announce/2008-November/msg00472.html
redhat.com / archives/fedora-package-announce/2008-November/msg00513.html
wiki.rpath.com / Advisories:rPSA-2008-0325
debian.org / security/2008/dsa-1666
Patch
mandriva.com / security/advisories
osvdb.org / 49993
redhat.com / support/errata/RHSA-2008-0988.html
securityfocus.com / bid/32326
ubuntu.com / usn/usn-673-1
vmware.com / security/advisories/VMSA-2009-0001.html
vupen.com / english/advisories/2008/3176
vupen.com / english/advisories/2009/0034
vupen.com / english/advisories/2009/0301
vupen.com / english/advisories/2009/0323
vupen.com / english/advisories/2009/1522
vupen.com / english/advisories/2009/1621