CVE-2024-56171 is a high severity use-after-free bug (CVSS 7.8) in libxml2's XML schema validation code. It affects releases before 2.12.10 and 2.13.x before 2.13.6. Update libxml2 to a fixed release or your operating system's patched package, and be careful with schemas or documents from untrusted sources.
What's affected
The CVE record says libxml2 before 2.12.10, and 2.13.x before 2.13.6, has a use-after-free in two functions in xmlschemas.c: xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables. To exploit it, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.
Fixed upstream versions are therefore 2.12.10 and 2.13.6, and later releases. libxml2 is a shared library, so many products embed it or load it from the operating system. The record lists NetApp Active IQ Unified Manager and other NetApp products among affected products. Check each vendor's own advisory for the version that carries the fix.
How to check if you're exposed
Find libxml2 wherever it hides. On a host, ask the command line tool and the package manager:
xmllint --version
dpkg -l | grep libxml2
rpm -qa | grep libxml2
For Python projects that use lxml, the library reports the libxml2 version it was built against:
python3 -c "import lxml.etree as e; print(e.LIBXML_VERSION, e.LIBXML_COMPILED_VERSION)"
Remember that Linux distributions often backport security fixes without changing the upstream version number. A package that reads as 2.9.14 may already contain the fix, so check your distribution's security tracker for this CVE before you decide.
Do not forget container images. Each image carries its own copy of the library, and the scan has to look inside the image.
What to do now
- Inventory libxml2 across hosts, container images and bundled copies in applications. Static binaries and vendored copies need their own check.
- Update to 2.12.10, 2.13.6 or later, or apply your distribution's patched package.
- Rebuild and redeploy container images so the new library actually reaches production.
- Check vendor advisories for appliances and products that embed libxml2, including the NetApp products named in the record.
- Avoid validating documents against schemas from untrusted sources until you are patched.
- Restart long running services that load the library, since an updated file on disk does not change a running process.
Why it matters
The weakness is CWE-416, use after free. The code frees a block of memory and later reads or writes through a pointer to it. Schema identity constraints (the XML equivalent of keys and unique rules) need bookkeeping tables, and the bug lies in how those tables were handled while validating. The result is memory corruption, which the vector in the record rates as high impact on confidentiality and integrity.
The score is held to 7.8 by two factors. The attack vector is local and attack complexity is high, because the attacker needs a crafted document or schema to reach the validation code. In practice, how reachable that is depends on the product. A service that validates uploaded XML against a schema you supply is a different risk from a tool that only parses trusted files. The KEV flag in the record is false. This is where reachability analysis helps: knowing whether your code calls schema validation at all tells you how fast to move.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is my libxml2 safe if the version number is lower than 2.12.10?
Not necessarily either way. Distributions backport fixes, so check your vendor's security tracker for this CVE rather than relying on the number.
Does parsing XML alone trigger this?
The record describes validation against an XML schema with identity constraints, or use of a crafted schema. Plain parsing is not what the description names.
Sources
Last reviewed: 19 October 2026.
