CVE-2021-3518

There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.

CVSS 3.1

8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

22% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-25)

CWE

CWE-416

Published

2021-05-18

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

Affected

• debian:debian_linux
• fedoraproject:fedora
• netapp:active_iq_unified_manager
• netapp:clustered_data_ontap
• netapp:clustered_data_ontap_antivirus_connector
• netapp:hci_h410c_firmware
• netapp:manageability_software_development_kit
• netapp:ontap_select_deploy_administration_utility
• netapp:snapdrive
• oracle:communications_cloud_native_core_network_function_cloud_native_environment
• oracle:enterprise_manager_base_platform
• oracle:enterprise_manager_ops_center
• oracle:mysql_workbench
• oracle:peoplesoft_enterprise_peopletools
• oracle:real_user_experience_insight
• redhat:enterprise_linux
• redhat:jboss_core_services
• xmlsoft:libxml2

Packages (OSV)

References

• http://seclists.org/fulldisclosure/2021/Jul/54
• http://seclists.org/fulldisclosure/2021/Jul/55
• http://seclists.org/fulldisclosure/2021/Jul/58
• http://seclists.org/fulldisclosure/2021/Jul/59
• https://bugzilla.redhat.com/show_bug.cgi?id=1954242

Check your stackJSON