Heap-Based Buffer Under-read in libxml2 Affects XML Validation
CVE-2025-32415

2.9LOW

Key Information:

Vendor

Xmlsoft

Status
Libxml2
Vendor
CVE Published:
17 April 2025

What is CVE-2025-32415?

A vulnerability in libxml2 prior to version 2.13.8 and 2.14.x before 2.14.2 allows for a heap-based buffer under-read. This can be exploited when a malicious XML document is validated against a specific XML schema requiring certain identity constraints or when a specially crafted XML schema is utilized. By triggering this vulnerability, attackers may gain unauthorized access to sensitive data or disrupt normal operations.

Affected Version(s)

libxml2 0 < 2.13.8

libxml2 2.14.0 < 2.14.2

References

https://gitlab.gnome.org/GNOME/libxml2/-/issues/890

CVSS V3.1

Score:
2.9
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-32415 : Heap-Based Buffer Under-read in libxml2 Affects XML Validation