CVE catalog

CVE-2018-11210

tinyxml2: CVE-2018-11210

Severity: Low
Published: May 16, 2018, 3:29:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 2.27% · Oct 25, 2026

TinyXML2 6.2.0 has a heap-based buffer over-read in the XMLDocument::Parse function in libtinyxml2.so. NOTE: The tinyxml2 developers have determined that the reported overflow is due to improper use of the library and not a vulnerability in tinyxml2

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	tinyxml2	sid	`11.0.0+dfsg-1`	vulnerable
Debian	tinyxml2	forky	`11.0.0+dfsg-1`	vulnerable
Debian	tinyxml2	trixie	`11.0.0+dfsg-1`	vulnerable
Debian	tinyxml2	bookworm	`9.0.0+dfsg-3.1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	tinyxml2	source	sid	`(unfixed)`	unimportant	Not reported	[899063]
Debian	tinyxml2	source	forky	`(unfixed)`	unimportant	Not reported	[899063]
Debian	tinyxml2	source	trixie	`(unfixed)`	unimportant	Not reported	[899063]
Debian	tinyxml2	source	bookworm	`(unfixed)`	unimportant	Not reported	[899063]

[Debian bug #899063]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libtinyxml2-9]Affected
Source package: [tinyxml2]
Details (2)
- 9.0.0+dfsg-3.1 · amd64 · bookworm
  Affected
  dsa · tinyxml2 · debian · bookworm; dsa · tinyxml2 · debian · 12
- 9.0.0+dfsg-3.1 · arm64 · bookworm
  Affected
  dsa · tinyxml2 · debian · bookworm; dsa · tinyxml2 · debian · 12
[libtinyxml2-dev]Affected
Source package: [tinyxml2]
Details (2)
- 9.0.0+dfsg-3.1 · amd64 · bookworm
  Affected
  dsa · tinyxml2 · debian · bookworm; dsa · tinyxml2 · debian · 12
- 9.0.0+dfsg-3.1 · arm64 · bookworm
  Affected
  dsa · tinyxml2 · debian · bookworm; dsa · tinyxml2 · debian · 12

[Debian 13 (Trixie)]

[libtinyxml2-11]Affected
Source package: [tinyxml2]
Details (2)
- 11.0.0+dfsg-1+b1 · amd64 · trixie
  Affected
  dsa · tinyxml2 · debian · 13
- 11.0.0+dfsg-1+b1 · arm64 · trixie
  Affected
  dsa · tinyxml2 · debian · 13
[libtinyxml2-dev]Affected
Source package: [tinyxml2]
Details (2)
- 11.0.0+dfsg-1+b1 · amd64 · trixie
  Affected
  dsa · tinyxml2 · debian · 13
- 11.0.0+dfsg-1+b1 · arm64 · trixie
  Affected
  dsa · tinyxml2 · debian · 13

Observed: Oct 23, 2026, 5:33:36 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]