CVE-2023-45322 Use after free in n/a

Medium 6.5 Published 6 Oct 2023 Updated 14 Oct 2026

A use-after-free in libxml2 can cause a denial of service when memory allocation fails, though exploitation is difficult.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2023-45322?

CVE-2023-45322 is a medium-severity use after free vulnerability in Xmlsoft Libxml2, published on 6 Oct 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail."

Weakness: CWE-416

Which versions are affected by CVE-2023-45322?

It affects 1 product.

Linux distribution packages (31)

`libxml2` SUSE:Linux Enterprise Micro 5.1	All versions	`2.9.7-150000.3.63.1`
`libxml2` SUSE:Linux Enterprise Micro 5.2	All versions	`2.9.7-150000.3.63.1`
`python-libxml2-python` SUSE:Linux Enterprise Micro 5.2	All versions	`2.9.7-150000.3.63.1`
`libxml2` SUSE:Linux Enterprise Micro 5.3	All versions	`2.9.14-150400.5.25.1`
`libxml2-python` SUSE:Linux Enterprise Micro 5.3	All versions	`2.9.14-150400.5.25.1`
`libxml2` SUSE:Linux Enterprise Micro 5.4	All versions	`2.9.14-150400.5.25.1`
`libxml2-python` SUSE:Linux Enterprise Micro 5.4	All versions	`2.9.14-150400.5.25.1`
`libxml2` SUSE:Linux Enterprise Micro 5.5	All versions	`2.10.3-150500.5.11.1`
`libxml2-python` SUSE:Linux Enterprise Micro 5.5	All versions	`2.10.3-150500.5.11.1`
`libxml2` SUSE:Linux Enterprise Module for Basesystem 15 SP4	All versions	`2.9.14-150400.5.25.1`
`libxml2-python` SUSE:Linux Enterprise Module for Basesystem 15 SP4	All versions	`2.9.14-150400.5.25.1`
`libxml2` SUSE:Linux Enterprise Module for Basesystem 15 SP5	All versions	`2.10.3-150500.5.11.1`
`libxml2-python` SUSE:Linux Enterprise Module for Basesystem 15 SP5	All versions	`2.10.3-150500.5.11.1`
`libxml2-python` SUSE:Linux Enterprise Module for Python 3 15 SP4	All versions	`2.9.14-150400.5.25.1`
`libxml2-python` SUSE:Linux Enterprise Module for Python 3 15 SP5	All versions	`2.10.3-150500.5.11.1`
`libxml2` SUSE:Linux Enterprise Server 12 SP5	All versions	`2.9.4-46.68.2`
`python-libxml2` SUSE:Linux Enterprise Server 12 SP5	All versions	`2.9.4-46.68.2`
`libxml2` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`2.9.4-46.68.2`
`python-libxml2` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`2.9.4-46.68.2`
`libxml2` SUSE:Linux Enterprise Software Development Kit 12 SP5	All versions	`2.9.4-46.68.2`
`libxml2` openSUSE:Leap 15.4	All versions	`2.9.14-150400.5.25.1`
`libxml2-python` openSUSE:Leap 15.4	All versions	`2.9.14-150400.5.25.1`
`python-libxml2-python` openSUSE:Leap 15.4	All versions	`2.9.7-150000.3.63.1`
`libxml2` openSUSE:Leap 15.5	All versions	`2.10.3-150500.5.11.1`
`libxml2-python` openSUSE:Leap 15.5	All versions	`2.10.3-150500.5.11.1`
`python-libxml2-python` openSUSE:Leap 15.5	All versions	`2.9.7-150000.3.63.1`
`libxml2` openSUSE:Leap Micro 5.3	All versions	`2.9.14-150400.5.25.1`
`libxml2-python` openSUSE:Leap Micro 5.3	All versions	`2.9.14-150400.5.25.1`
`libxml2` openSUSE:Leap Micro 5.4	All versions	`2.9.14-150400.5.25.1`
`libxml2-python` openSUSE:Leap Micro 5.4	All versions	`2.9.14-150400.5.25.1`
`libxml2` openSUSE:Tumbleweed	All versions	`2.11.5-2.1`

Products include Xmlsoft Libxml2.

How do I fix CVE-2023-45322?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2023-45322 being exploited?

There is no known exploitation of CVE-2023-45322 in the wild and no public exploit code.

All Xmlsoft Libxml2 vulnerabilities

Sources

Also known as AZL-31272, AZL-34960, BELL-CVE-2023-45322, DEBIAN-CVE-2023-45322, ECHO-86f2-08fd-b895, GHSA-vqpg-m25j-7558 and 7 more.