CVE-2017-5969: Xmlsoft LIBXML2

Medium severity, CVSS 4.7. EPSS: 2.6% chance of exploitation in the next 30 days.

libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML document. NOTE: The maintainer states "I would disagree of a CVE with the Recover parsing option which should only be used for manual recovery at least for XML parser.

Affected products

• Xmlsoft LIBXML2: version 2.9.4 only

Published 2017-04-11. Last modified 2026-06-17.