VYPR
← All advisories
High severityNVD Advisory· Published May 18, 2021· Updated Aug 3, 2024

CVE-2021-3518

CVE-2021-3518

Description

There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A use-after-free vulnerability in libxml2 before 2.9.11 allows attackers to cause confidentiality, integrity, and availability impacts via crafted files.

Vulnerability

A use-after-free flaw exists in libxml2 versions prior to 2.9.11. An attacker who can supply a crafted file to an application linked with libxml2 can trigger this memory corruption issue.

Exploitation

The attacker needs only the ability to submit a crafted file to be processed by a vulnerable application. No authentication or special privileges are required. The crafted file triggers a use-after-free condition during parsing.

Impact

Successful exploitation can lead to disclosure of sensitive information, corruption of data, or denial of service. The description notes the greatest impact is to confidentiality, integrity, and availability.

Mitigation

The vulnerability is fixed in libxml2 version 2.9.11. Users should upgrade to this version or later. No workarounds are mentioned in the available references.

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
nokogiriRubyGems
< 1.11.41.11.4

Affected products

46

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

29

News mentions

0

No linked articles in our index yet.