Technical impact
The flaw exists in the interactive shell of the XML lint tool provided by libxml2, which parses XML files. An attacker who can supply an excessively long command causes the program to read beyond allocated memory. The result is a crash, with the description noting that in rare configurations lacking modern protections the overflow could lead to execution of harmful code. Though the immediate effect is denial of service, the underlying buffer overflow introduces a potential remote code execution vector.
Affected Systems
Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, Red Hat JBoss Core Services, and Red Hat OpenShift Container Platform 4 rely on libxml2 and hence are affected. The vulnerability applies to all recent releases of these products, including hardened and containered images.
Risk and Exploitability
The CVSS score of 2.5 reflects a low overall severity, and the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, further suggesting it is not actively exploited by adversaries. Likely attack vectors are local users who can invoke the xmllint interactive shell. In environments where modern mitigations are disabled or minimal, an attacker could trigger a buffer overflow to run arbitrary code; otherwise the primary danger remains a crash that may impact availability.
Debian DLA
EUVD
Ubuntu USN