CVE-2018-9251

Exp

The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035.

Published: 2018-04-03 Last update: 2026-06-16 Assigner: [email protected] Source: [email protected]

NVD Status：Modified，CVE State: published

View at NVD, CVE.org, EUVD

Threat Intelligence & Risk Assessment for CVE-2018-9251

EPSS CVSS CWE Exploit-DB Affected OS Tracker

Conclusion & alert: CVE-2018-9251 is rated High Exploit Risk (66.6/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 2.44%). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). EPSS rose +1.67% over the last day, indicating growing attacker interest. Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2018-9251

EDB-ID	Source	Kind	Published	Link
—	nvd_ref	exploit_tag		Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2018-9251

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	0.77%	2.44%	+1.67%
2	2026-03-13	0.97%	0.77%	-0.20%
3	2025-11-21	—	0.97%	—

Full EPSS history (14 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2018-9251

CVSS metrics for this CVE.

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
5.3	3.0	MEDIUM	`CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:R) A real person has to do something—click, install, enable—otherwise it doesn’t land. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	1.6	3.6	[email protected]
2.6	2.0	LOW	`AV:N/AC:H/Au:N/C:N/I:N/A:P` Click to expand Access vector (AV:N) Can be exploited remotely over network reachability. Access complexity (AC:H) Exploitation requires uncommon or highly specific conditions. Authentication (AU:N) No authentication is required. Confidentiality impact (C:N) No confidentiality impact. Integrity impact (I:N) No integrity impact. Availability impact (A:P) Partial availability impact.	4.9	2.9	[email protected]

Weakness enumeration for CVE-2018-9251

CWE-835 MITRE ↗

OS Trackers for CVE-2018-9251

vendor	priority	summary	link
`alpine`	medium	CVE-2018-9251: 2 source package rows (libxml2, libxml2.13); 16 state rows across 10 repos (3.10-main, 3.11-main, 3.12-main, 3.17-main, 3.18-main, 3.19-main, 3.20-main, 3.21-main, 3.22-main, edge-main); fixed 16, open 0.	https://security.alpinelinux.org/vuln/CVE-2018-9251
`debian`	unimportant	CVE-2018-9251 unimportant priority: Debian including 1 source packages (libxml2), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5.	https://security-tracker.debian.org/tracker/CVE-2018-9251
`redhat`	low	—	https://access.redhat.com/security/cve/CVE-2018-9251
`suse`	low	CVE-2018-9251 severity low: SUSE including 437 source package names (0.1.0:libxml2-2-2.9.7-3.3.1, 0.1.75:libxml2-2-2.9.7-3.3.1, …), 642 product×package rows across 237 product lines (Container bci/bci-init, Container bci/dotnet-aspnet, … (237 product lines)): Fixed 471, Known Affected 157, Known Not Affected 14.	https://www.suse.com/security/cve/CVE-2018-9251/
`ubuntu`	medium	CVE-2018-9251 medium priority: Ubuntu including 1 source packages (libxml2), 4 status rows across 4 suites (artful, trusty, upstream, xenial): not-affected 3, released 1.	https://ubuntu.com/security/CVE-2018-9251

Affected software / configurations for CVE-2018-9251

Vendor	Product	Version	Raw CPE
xmlsoft	libxml2	2.9.8	cpe:2.3:a:xmlsoft:libxml2:2.9.8:::::::*
debian	debian_linux	8.0	cpe:2.3:o:debian:debian_linux:8.0:::::::*

References for CVE-2018-9251

URL	Tags
https://bugzilla.gnome.org/show_bug.cgi?id=794914	Exploit Issue Tracking Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html	Third Party Advisory

cvelogic Threat Intelligence