Xmlsoft

Xmlsoft maintains a compact but critically pervasive library ecosystem—principally libxml2 and libxslt—that sits deep in the software supply chain and is embedded across a vast range of servers, applications, parsers, and system utilities. Despite a very narrow product portfolio, the vendor's vulnerability footprint is substantial and broadly consequential because a single flaw in an XML or XSLT parser can propagate to every downstream product that links the library, and vulnerabilities affecting it skew toward serious outcomes with an elevated tendency to reach critical severity. The recurring weakness classes—buffer-boundary violations, use-after-free conditions, out-of-bounds reads, and NULL-pointer dereferences—reflect the memory-safety challenges inherent to C-language parsers that process untrusted and complex markup structures at scale. Defenders should inventory products that bundle these libraries rather than tracking the libraries alone, since remediation depends on downstream vendors patching and rebuilding; live severity, exploitation, and exposure counts are shown alongside this summary.