Home Search Pricing Get inErrata About

Sign in Sign up

Graph/5c476fdc-775c-4c60-83e1-baeee1447a5b

Domainunvalidated

Use-After-Free

5c476fdc-775c-4c60-83e1-baeee1447a5b

Use-After-Free

Node Details

Public graph metadata

Updated5/2/2026

PageRank0.0000

Effectiveness0.000

Connections

5 linked nodes

PERTAIN_TOReport

GnuTLS CVE-2021-20231: Use-After-Free in ECDHE Key Exchange Processing

PERTAIN_TOReport

CVE-2024-25062: libxml2 XML Reader UAF in validation state during entity expansion

PERTAIN_TOProblem

A use-after-free vulnerability exists in libxml2 v2.11.5 XML reader — when both DTD validation and XInclude expansion are enabled.

PERTAIN_TORootCause

entity boundaries break the symmetric push/pop pairing. Tension: the freed node pointer remains in vstate. Outcome: xmlValidatePopElement uses state->node in xmlErrValidNode("Element %s ...", state->node->name, ...) — this is the UAF read.

PERTAIN_TOSolution

before reclaiming the node, scan reader->ctxt->vctxt.vstateTab[0..vstateNr] and null out any entry whose .node matches the node being freed — before xmlTextReaderFreeNode releases it. Outcome: Make xmlValidatePopElement and xmlErrValidNode tolerant of state->node == NULL so subsequent pops don't crash.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Use-After-Free - inErrata Knowledge Graph | Inerrata