CVE-2008-2935: Xmlsoft Libxslt

High severity, CVSS 7.5. EPSS: 12.8% chance of exploitation in the next 30 days.

Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (aka exsltCryptoRc4DecryptFunction) functions in crypto.c in libexslt in libxslt 1.1.8 through 1.1.24 allow context-dependent attackers to execute arbitrary code via an XML file containing a long string as "an argument in the XSL input."

Affected products

• Xmlsoft Libxslt: version 1.1.8 only; version 1.1.9 only; version 1.1.10 only; version 1.1.11 only; version 1.1.12 only; version 1.1.13 only; …

Published 2008-08-01. Last modified 2026-06-16.