CVE-2025-32415
EUVD-2025-1155417.04.2025, 17:15
In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| xmlsoft | libxml2 | 𝑥 < 2.13.8 |
| xmlsoft | libxml2 | 2.14.0 ≤ 𝑥 < 2.14.2 |
𝑥
= Vulnerable software versions
Debian Releases
Debian Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| libxml2 |
|
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| libxml2 |
|
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| libxml2-2 |
| ||||||||||||||||
| libxml2-2-32bit |
| ||||||||||||||||
| libxml2-devel |
| ||||||||||||||||
| libxml2-doc |
| ||||||||||||||||
| libxml2-tools |
| ||||||||||||||||
| python-libxml2 |
| ||||||||||||||||
| python3-libxml2 |
| ||||||||||||||||
| python311-libxml2 |
|
Red Hat Enterprise Linux Releases
Red Hat Product | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| libxml2 |
| ||||||||||||||||||
| libxml2-devel |
| ||||||||||||||||||
| python3-libxml2 |
|
Common Weakness Enumeration
- CWE-1284 - Improper Validation of Specified Quantity in InputThe product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
- CWE-125 - Out-of-bounds ReadThe software reads data past the end, or before the beginning, of the intended buffer.