CVE catalog

CVE-2024-50614

tinyxml2: CVE-2024-50614

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.44% · Oct 25, 2026

TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiantinyxml2sid11.0.0+dfsg-1vulnerable
Debiantinyxml2forky11.0.0+dfsg-1vulnerable
Debiantinyxml2trixie11.0.0+dfsg-1vulnerable
Debiantinyxml2bookworm9.0.0+dfsg-3.1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiantinyxml2sourcesid(unfixed)not yet assignedNot reported[1088813]
Debiantinyxml2sourceforky(unfixed)not yet assignedNot reported[1088813]
Debiantinyxml2sourcetrixie(unfixed)not yet assignedNot reported[1088813]
Debiantinyxml2sourcebookworm(unfixed)not yet assignedNot reported[1088813]

[Debian bug #1088813]

Notes

[trixie] tinyxml2: Minor issue, revisit when fixed upstream [bookworm] tinyxml2: Minor issue, revisit when fixed upstream

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libtinyxml2-9]Affected

    Source package: [tinyxml2]

    Details (2)

    • 9.0.0+dfsg-3.1 · amd64 · bookworm

      Affected

      dsa · tinyxml2 · debian · bookworm; dsa · tinyxml2 · debian · 12

    • 9.0.0+dfsg-3.1 · arm64 · bookworm

      Affected

      dsa · tinyxml2 · debian · bookworm; dsa · tinyxml2 · debian · 12

  • [libtinyxml2-dev]Affected

    Source package: [tinyxml2]

    Details (2)

    • 9.0.0+dfsg-3.1 · amd64 · bookworm

      Affected

      dsa · tinyxml2 · debian · bookworm; dsa · tinyxml2 · debian · 12

    • 9.0.0+dfsg-3.1 · arm64 · bookworm

      Affected

      dsa · tinyxml2 · debian · bookworm; dsa · tinyxml2 · debian · 12

[Debian 13 (Trixie)]

  • [libtinyxml2-11]Affected

    Source package: [tinyxml2]

    Details (2)

    • 11.0.0+dfsg-1+b1 · amd64 · trixie

      Affected

      dsa · tinyxml2 · debian · 13

    • 11.0.0+dfsg-1+b1 · arm64 · trixie

      Affected

      dsa · tinyxml2 · debian · 13

  • [libtinyxml2-dev]Affected

    Source package: [tinyxml2]

    Details (2)

    • 11.0.0+dfsg-1+b1 · amd64 · trixie

      Affected

      dsa · tinyxml2 · debian · 13

    • 11.0.0+dfsg-1+b1 · arm64 · trixie

      Affected

      dsa · tinyxml2 · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]