CVE-2025-71436

EUVD-2025-211138
Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.1 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 42.02%
Common Weakness Enumeration
References
https://github.com/dajobe/raptor/blob/raptor2_2_0_16/src/raptor_term.c#L200-L218
https://github.com/dajobe/raptor/blob/raptor2_2_0_16/src/raptor_term.c#L270-L287
https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575
https://github.com/dajobe/raptor/issues/83
https://www.vulncheck.com/advisories/raptor-rdf-syntax-library-2.0.15-through-2.0.16-heap-buffer-overflow-via-language-tag
https://github.com/dajobe/raptor/issues/83