CVE-2015-5522: Heap-based buffer overflow in the ParseValue function in lexer.c in tidy before 4.9.31 allows remote attack...

Security readout for executives and security teams

CVE-2015-5522 is a crash bug in HTML Tidy. A specially crafted href value can trigger a heap buffer overflow while Tidy parses HTML, causing denial of service. The source bundle names Tidy before 4.9.31, but provides no CVSS score and no evidence of active exploitation. Exposure is most likely where Tidy, tidy-html5, or OS-packaged HTML Tidy parses untrusted or externally supplied HTML. Apple, Ubuntu, and Debian advisories indicate downstream packaged exposure, but the bundle does not provide precise affected package versions. Handle as a moderate availability risk. Prioritize internet-facing or business-critical workflows that process untrusted HTML, but do not treat it as confirmed ransomware-grade or actively exploited based on the provided evidence. Mitigation focus: Upgrade Tidy to 4.9.31 or later where applicable.; Apply relevant Apple, Ubuntu, or Debian security updates.; Check vendor advisories for exact fixed package versions..

Prepared

Jun 13, 2026, 22:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.