Heap-Based Buffer Overflow in Raptor RDF Syntax Library Affects Applications
CVE-2025-71436

7.1HIGH

Key Information:

Vendor

Librdf

Status
Raptor Rdf Syntax Library
Vendor
CVE Published:
20 October 2026

What is CVE-2025-71436?

The Raptor RDF Syntax Library versions 2.0.15 to 2.0.16 is susceptible to a heap-based buffer overflow vulnerability. This issue arises in the function raptor_new_term_from_counted_literal(), where language tag lengths can be truncated to an unsigned char. Attackers can exploit this vulnerability by supplying Turtle, TriG, N-Triples, or N-Quads documents with language tags exceeding 256 bytes, leading to potential heap memory corruption, application crashes, or even arbitrary code execution.

Affected Version(s)

Raptor RDF Syntax Library 2.0.15 <= 2.0.16

References

https://github.com/dajobe/raptor/issues/83
issue-tracking
https://github.com/dajobe/raptor/commit/361a803a72817ae77...
patch
https://github.com/dajobe/raptor/blob/raptor2_2_0_16/src/...
technical-description

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pedro Ribeiro (@pedrib1337) from Agile Information Security
.