The archive/CVE-2025-24928

libxml2Disclosed 2025

CVE-2025-24928:libxml2: Stack buffer overflow via cumulative strcat with stale lengt

A historical CVE, retraced through the questions Lachesis asks of vulnerable code.

Historical record2.13.5 (git v2.13.5)

WeaknessCWE-787 → CWE-121 · Stack buffer overflow via cumulative strcat with stale lengt

ImpactA stack buffer overflow via cumulative strcat with stale lengt in libxml2, reachable from attacker-controlled input.

Read the reconstruction ↓

01What happened

The length check passed, but it measured the buffer before another prefix was added. Together, the pieces overflowed the stack.

That is the shape of the failure. The rest of this case file follows the evidence behind it.

Separate the record from the run

What was known.
What Lachesis established.

01Historical record

Known before Lachesis ran

The CVE and vulnerable release were selected from public history. We are not claiming novel discovery.

CVE: CVE-2025-24928
Vulnerable target: 2.13.5 (git v2.13.5) · vulnerable
Prior knowledge: CVE-2025-24928 · 2.13.5 (git v2.13.5) is vulnerable

then→

02Lachesis run

Verified captured run

Independent re-detection

No source/sink/guard fed from memory. CVE picked from libxml2's own in-tree NEWS; vulnerable body + fix confirmed from the v2.13.5 -> v2.14.1 diff, not memory.

Seeded inputs: None
Run timestamp: 2026-08-24T12:06:09Z
Evidence artifact: ~/.lachesis/graphs/libxml2_validc_24928_rebuild.kuzu

The commands and outputs below come from this recorded Lachesis run.

The reconstruction, in one frame

What Lachesis reconstructed.

One historical repository. Four captured queries. A complete source-to-sink argument.

Lachesis Casefiles · Unbound ComputeVerified runCVE-2025-24928

A stale length let two checked pieces overflow one stack buffer.

01Sourcestrcat(buf, (char *) cur->name) // cur->name from parsed document

→

02Sinkstrcat(buf, (char *) cur->name);

→

03Missing guardif (size - len < xmlStrlen(cur->name) + 10)

$ lachesis sources_of → reaches → guard_dominance

libxml2 · 2.13.5 (git v2.13.5) · vulnerableunboundcompute.com

↳

This was known history. Your code is not.

Lachesis follows the same evidence path through unfamiliar repositories.

Run Lachesis on your repository ↗

The Lachesis reconstruction

Here is how the path becomes visible.

These are the recorded questions Lachesis asked of the historical vulnerable code, followed by the raw result and source location each query returned.

Repositorylibxml2

Revision2.13.5 (git v2.13.5) · vulnerable

EngineLachesis

Captured runThis block reflects the real blind drive of the graph we built for libxml2. We loaded the whole graph, listed every bug family with nothing chosen ahead of time, and the two unbounded string appends came out among the top ranked buffer write sinks. The candidate facts below are the ones captured on that drive on that drive. No document was seeded; the finding was rediscovered from graph structure, so the mode is independent-redetection.

01 · load_graph01 / 05

Lachesis ran

load_graph --path ~/.lachesis/graphs/libxml2_validc_24928_rebuild.kuzu --profile all && candidate_census

Load the graph and list every bug family

First we load the graph and ask the tool to list every bug family, with nothing picked ahead of time. It reports all 8 domains and 31 sink constructors and says the census is complete for what the graph can observe. The memory copy family is one row among all of them.

Captured resultCaptured · load_graph

raw captured outputload_graph

{"move": "load_graph", "graph": "/Users/riyandhiman/.lachesis/graphs/libxml2_validc_24928_rebuild.kuzu", "profile": "all"}

CANDIDATE_CENSUS
move: candidate_census
taxonomy (8):
  domain=lifecycle         title=Resource lifecycle              enumerable=True
  domain=memory            title=Memory safety                   enumerable=True
  domain=injection         title=Injection                       enumerable=True
  domain=navigation        title=Request forgery & redirection   enumerable=True
  domain=object-integrity  title=Object integrity                enumerable=True
  domain=filesystem        title=Filesystem                      enumerable=True
  domain=crypto-config     title=Cryptography & transport config enumerable=True
  domain=resource          title=Resource exhaustion             enumerable=True
constructors (31): complete_for_observable_graph=True
applied: True

valid.cline 0

Code location returned for this evidence step.

The repair

A small line with a large consequence.

len is stale after the prefix and colon were appended, so the check does not reflect the true remaining capacity. The combined prefix, colon, and name can exceed the buffer.

Before

if (size - len < xmlStrlen(cur->name) + 10)

After the patch

// Compute qnameLen = name + (prefix ? prefix+1 : 0) and check 'size - len < qnameLen + 10' once, before appending anything.

Sources & further reading

The original record.

Read the historical advisory and vulnerability record behind this reconstruction.

NVD record ↗Unbound security blog ↗Lachesis at Unbound Compute ↗

Open the Lachesis quickstart ↗