An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a re…

Published 8 y ago 2018-02-07 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.8

v3.1 · CNA

CISA KEV

not known exploited

EPSS

2.7%

percentile 86%

Public exploits

none known

An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted XML file.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 11 mo ago 2025-12-03

Exploit prediction (EPSS)

2.71% probability of exploitation in the next 30 days, higher than 86% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	8.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
CNA	3.1	8.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
NVD	3.0	8.8	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
NVD	2.0	6.8	`AV:N/AC:M/Au:N/C:P/I:P/A:P`

Affected products

n/a Google Chrome prior to 62.0.3202.62

Classification

Weakness

CWE-190 Integer Overflow or Wraparound
CWE-787 Out-of-bounds Write

Technology feeds

Google Chrome (RSS, critical only)

References

securityfocus.com /bid/101482 · vdb-entry, x_refsource_BID, x_transferred
lists.debian.org /debian-lts-announce/2017/11/msg00034.html · mailing-list, x_refsource_MLIST, x_transferred
bugzilla.gnome.org /show_bug.cgi?id=783026 · x_refsource_MISC, x_transferred
chromereleases.googleblog.com /2017/10/stable-channel-update-for-desktop.html · x_refsource_MISC, x_transferred
git.gnome.org /browse/libxml2/commit/?id=897dffbae322b46b83f99a607d527058a72c51ed · x_refsource_MISC, x_transferred
access.redhat.com /errata/RHSA-2017:2997 · vendor-advisory, x_refsource_REDHAT, x_transferred
crbug.com /722079 · x_refsource_MISC, x_transferred
security.gentoo.org /glsa/201710-24 · vendor-advisory, x_refsource_GENTOO, x_transferred
security.netapp.com /advisory/ntap-20190719-0001/ · x_refsource_CONFIRM, x_transferred
oracle.com /security-alerts/cpuapr2020.html · x_refsource_MISC, x_transferred
lists.debian.org /debian-lts-announce/2022/04/msg00004.html · mailing-list, x_refsource_MLIST, x_transferred

Sources

CVE List: CVE-2017-5130
NVD: CVE-2017-5130

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary