CVE-2017-9050: Xmlsoft LIBXML2

High severity, CVSS 7.5. EPSS: 4.6% chance of exploitation in the next 30 days.

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.

Affected products

• Xmlsoft LIBXML2: version 2.9.4 only

Published 2017-05-18. Last modified 2026-06-17.