CVE-2023-45322 is a use-after-free vulnerability in libxml2 versions through 2.11.5, specifically within the xmlUnlinkNode function in tree.c, which can only manifest after a memory allocation failure. This vulnerability carries a CVSS score of 6.5 (Medium), indicating it can be exploited remotely with low attack complexity, requiring user interaction, and potentially leading to high availability impact. Despite its technical nature, the vendor considers it non-critical due to the attacker's inability to control memory allocation failures. Currently, there is no evidence of active exploitation, nor are there public exploit modules or significant community discussion, though it was mentioned in a GitLab security release.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.11.5CPE matchmatch criteria | cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail."
Oct 10, 2023libxml2: use-after-free in xmlUnlinkNode() in tree.c
Aug 23, 2023