CVE-2008-4409: Xmlsoft LIBXML2

Medium severity, CVSS 5.0. EPSS: 8.5% chance of exploitation in the next 30 days.

libxml2 2.7.0 and 2.7.1 does not properly handle "predefined entities definitions" in entities, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash), as demonstrated by use of xmllint on a certain XML document, a different vulnerability than CVE-2003-1564 and CVE-2008-3281.

Affected products

• Xmlsoft LIBXML2: version 2.7.0 only; version 2.7.1 only

Published 2008-10-03. Last modified 2026-06-16.