CVE-2011-1944: Xmlsoft Libxml

High severity, CVSS 9.3. EPSS: 13.4% chance of exploitation in the next 30 days.

Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.

Affected products

• Xmlsoft Libxml: up to and including 1.8.16; version 1.5.0 only; version 1.6.0 only; version 1.6.1 only; version 1.6.2 only; version 1.7.0 only; …
• Xmlsoft LIBXML2: version 2.6.0 only; version 2.6.1 only; version 2.6.2 only; version 2.6.3 only; version 2.6.4 only; version 2.6.5 only; …

Published 2011-09-02. Last modified 2026-06-16.