CVE-2024-50614
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application...
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.
- Record
CVE-2024-50614- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-617
- Updated
- 2026-11-02
EUVDEUVD-2024-44977
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.
- Record
EUVD-2024-44977- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xpm9-95h9-q996
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application...
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.
- Record
GHSA-xpm9-95h9-q996- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-617
- Updated
- 2026-11-02
NVD
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.
- Record
CVE-2024-50614- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-617
- Updated
- 2026-11-02
OSV
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.
- Record
CVE-2024-50614- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-50614
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.
- Record
DEBIAN-CVE-2024-50614- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 10 moreShow less
OSVOESA-2026-1247
tinyxml2 security update
TinyXML-2 is a simple, small, efficient, C++ XML parser that can be easily integrated into other programs. TinyXML-2 parses an XML document, and builds from that a Document Object Model (DOM) that can be read, modified, and saved.
Security Fix(es):
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.(CVE-2024-50614)
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/digit, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.(CVE-2024-50615)
- Record
OESA-2026-1247- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-1282
tinyxml2 security update
TinyXML-2 is a simple, small, efficient, C++ XML parser that can be easily integrated into other programs. TinyXML-2 parses an XML document, and builds from that a Document Object Model (DOM) that can be read, modified, and saved.
Security Fix(es):
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.(CVE-2024-50614)
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/digit, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.(CVE-2024-50615)
- Record
OESA-2026-1282- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-1283
tinyxml2 security update
TinyXML-2 is a simple, small, efficient, C++ XML parser that can be easily integrated into other programs. TinyXML-2 parses an XML document, and builds from that a Document Object Model (DOM) that can be read, modified, and saved.
Security Fix(es):
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.(CVE-2024-50614)
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/digit, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.(CVE-2024-50615)
- Record
OESA-2026-1283- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-1284
tinyxml2 security update
TinyXML-2 is a simple, small, efficient, C++ XML parser that can be easily integrated into other programs. TinyXML-2 parses an XML document, and builds from that a Document Object Model (DOM) that can be read, modified, and saved.
Security Fix(es):
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.(CVE-2024-50614)
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/digit, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.(CVE-2024-50615)
- Record
OESA-2026-1284- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-1349
tinyxml2 security update
TinyXML-2 is a simple, small, efficient, C++ XML parser that can be easily integrated into other programs. TinyXML-2 parses an XML document, and builds from that a Document Object Model (DOM) that can be read, modified, and saved.
Security Fix(es):
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.(CVE-2024-50614)
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/digit, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.(CVE-2024-50615)
- Record
OESA-2026-1349- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-1350
tinyxml2 security update
TinyXML-2 is a simple, small, efficient, C++ XML parser that can be easily integrated into other programs. TinyXML-2 parses an XML document, and builds from that a Document Object Model (DOM) that can be read, modified, and saved.
Security Fix(es):
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.(CVE-2024-50614)
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/digit, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.(CVE-2024-50615)
- Record
OESA-2026-1350- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-50614
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.
- Record
UBUNTU-CVE-2024-50614- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-51874 No score
CVE-2024-50614 affecting package cppcheck 2.7-2
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.
- Record
AZL-51874- Updated
- 2026-11-02
OSVAZL-51887 No score
CVE-2024-50614 affecting package cppcheck for versions less than 2.18.3-1
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.
- Record
AZL-51887- Updated
- 2026-11-02
OSVAZL-51900 No score
CVE-2024-50614 affecting package blobfuse 1.4.5-17
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.
- Record
AZL-51900- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cppcheckAzure Linux:2 |
through 2.7-2 | None known |
cppcheckAzure Linux:3 |
before 2.18.3-1 | 2.18.3-1 |
blobfuseAzure Linux:2 |
through 1.4.5-17 | None known |
tinyxml2Debian:12 |
All versions, plus listed versions 10.0.0+dfsg-210.1.0+dfsg-111.0.0+dfsg-19.0.0+dfsg-3.1 |
None known |
tinyxml2Debian:13 |
All versions, plus listed versions 11.0.0+dfsg-1 |
None known |
tinyxml2Debian:14 |
All versions, plus listed versions 11.0.0+dfsg-1 |
None known |
tinyxml2openEuler:24.03-LTS-SP3 From an advisory covering 2 CVEs |
before 9.0.0-2.oe2403sp3 | 9.0.0-2.oe2403sp3 |
tinyxml2openEuler:24.03-LTS From an advisory covering 2 CVEs |
before 9.0.0-2.oe2403 | 9.0.0-2.oe2403 |
tinyxml2openEuler:24.03-LTS-SP1 From an advisory covering 2 CVEs |
before 9.0.0-2.oe2403sp1 | 9.0.0-2.oe2403sp1 |
tinyxml2openEuler:20.03-LTS-SP4 From an advisory covering 2 CVEs |
before 6.0.0-6.oe2003sp4 | 6.0.0-6.oe2003sp4 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tinyxml2openEuler:22.03-LTS-SP4 From an advisory covering 2 CVEs |
before 6.0.0-6.oe2203sp4 | 6.0.0-6.oe2203sp4 |
tinyxml2openEuler:24.03-LTS-SP2 From an advisory covering 2 CVEs |
before 9.0.0-2.oe2403sp2 | 9.0.0-2.oe2403sp2 |
tinyxml2Ubuntu:14.04:LTS |
All versions, plus listed versions 0~git20120518.1.a2ae54e-1 |
None known |
tinyxml2Ubuntu:16.04:LTS |
All versions, plus listed versions 2.2.0-1.1ubuntu1 |
None known |
tinyxml2Ubuntu:18.04:LTS |
All versions, plus listed versions 5.0.1-16.0.0+dfsg-1 |
None known |
tinyxml2Ubuntu:20.04:LTS |
All versions, plus listed versions 7.0.0+dfsg-17.0.0+dfsg-1build1 |
None known |
tinyxml2Ubuntu:22.04:LTS |
All versions, plus listed versions 8.1.0+really8.0.0+dfsg-19.0.0+dfsg-3 |
None known |
tinyxml2Ubuntu:24.04:LTS |
All versions, plus listed versions 9.0.0+dfsg-3.110.0.0+dfsg-2 |
None known |
tinyxml2Ubuntu:25.10 |
All versions, plus listed versions 10.0.0+dfsg-211.0.0+dfsg-1 |
None known |
tinyxml2Ubuntu:26.10 |
All versions, plus listed versions 11.0.0+dfsg-1build1 |
None known |
tinyxml2Ubuntu:26.04:LTS |
All versions, plus listed versions 11.0.0+dfsg-111.0.0+dfsg-1build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-50614 is a medium vulnerability (CVSS 6.5) in Tinyxml2 Project Tinyxml2, published October 27, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in cppcheck 2.18.3-1.
References
github.com/leethomason/tinyxml2/issues/996
nvd.nist.gov/vuln/detail/CVE-2024-50614
security-tracker.debian.org/tracker/CVE-2024-50614
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-1247
Show 8 moreShow less
ubuntu.com/security/CVE-2024-50614
cve.org/CVERecord?id=CVE-2024-50614