CVE-2017-18258: Xmlsoft LIBXML2

Medium severity, CVSS 6.5. EPSS: 2.7% chance of exploitation in the next 30 days.

The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.

Affected products

• Xmlsoft LIBXML2: before 2.9.6 (fixed in 2.9.6)

Published 2018-04-08. Last modified 2026-06-17.