In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.
CVSS Details
- CVSS 3.1 Base Score: 2.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-libxml2alma-upgrade-libxml2-develalma-upgrade-python3-libxml2 | Aug 7, 2025 | Aug 6, 2025 | |
| Alpine Linux | alpine-linux-upgrade-libxml2 | Aug 8, 2025 | Apr 17, 2025 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-libxml2amazon-linux-ami-2-upgrade-libxml2-debuginfoamazon-linux-ami-2-upgrade-libxml2-develamazon-linux-ami-2-upgrade-libxml2-pythonamazon-linux-ami-2-upgrade-libxml2-static | May 30, 2025 | Apr 17, 2025 | |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-libxml2amazon-linux-2023-upgrade-libxml2-debuginfoamazon-linux-2023-upgrade-libxml2-debugsourceamazon-linux-2023-upgrade-libxml2-develamazon-linux-2023-upgrade-libxml2-staticamazon-linux-2023-upgrade-python3-libxml2amazon-linux-2023-upgrade-python3-libxml2-debuginfo | May 14, 2025 | Apr 17, 2025 | |
| Debian | debian-upgrade-libxml2 | May 2, 2025 | Apr 17, 2025 | |
| Huawei Euleros 2_0_sp10 | huawei-euleros-2_0_sp10-upgrade-libxml2huawei-euleros-2_0_sp10-upgrade-python3-libxml2 | Jul 11, 2025 | Apr 17, 2025 | |
| Huawei Euleros 2_0_sp11 | huawei-euleros-2_0_sp11-upgrade-libxml2huawei-euleros-2_0_sp11-upgrade-python3-libxml2 | Jun 13, 2025 | Apr 17, 2025 | |
| Huawei Euleros 2_0_sp12 | huawei-euleros-2_0_sp12-upgrade-libxml2huawei-euleros-2_0_sp12-upgrade-python3-libxml2 | Jul 21, 2025 | Apr 17, 2025 | |
| Huawei Euleros 2_0_sp13 | huawei-euleros-2_0_sp13-upgrade-libxml2huawei-euleros-2_0_sp13-upgrade-python3-libxml2 | Aug 13, 2025 | Jun 12, 2025 | |
| Ibm Aix | ibm-aix-libxml2_advisory8 | Jun 5, 2025 | Apr 17, 2025 | |
| Nutanix Ahv | nutanix-ahv-upgrade-latest | Jun 5, 2026 | Oct 10, 2025 | |
| Oracle_linux | — | oracle-linux-upgrade-libxml2oracle-linux-upgrade-libxml2-develoracle-linux-upgrade-libxml2-pythonoracle-linux-upgrade-libxml2-staticoracle-linux-upgrade-python3-libxml2 | Aug 12, 2025 | Apr 17, 2025 |
| Redhat_linux | redhat-upgrade-libxml2redhat-upgrade-libxml2-debuginforedhat-upgrade-libxml2-debugsourceredhat-upgrade-libxml2-develredhat-upgrade-libxml2-pythonredhat-upgrade-libxml2-staticredhat-upgrade-python3-libxml2redhat-upgrade-python3-libxml2-debuginfo | Jul 9, 2025 | Apr 17, 2025 | |
| Rocky_linux | rocky-upgrade-libxml2rocky-upgrade-libxml2-debuginforocky-upgrade-libxml2-debugsourcerocky-upgrade-libxml2-develrocky-upgrade-libxml2-staticrocky-upgrade-python3-libxml2rocky-upgrade-python3-libxml2-debuginfo | Feb 5, 2026 | Oct 3, 2025 | |
| Splunk | splunk-upgrade-latest | Oct 6, 2025 | Apr 17, 2025 | |
| Suse | — | suse-upgrade-libxml2-2suse-upgrade-libxml2-2-32bitsuse-upgrade-libxml2-develsuse-upgrade-libxml2-devel-32bitsuse-upgrade-libxml2-docsuse-upgrade-libxml2-toolssuse-upgrade-python-libxml2suse-upgrade-python3-libxml2suse-upgrade-python3-libxml2-pythonsuse-upgrade-python311-libxml2suse-upgrade-python313-libxml2 | Dec 5, 2025 | Aug 7, 2025 |
| Ubuntu | ubuntu-pro-upgrade-libxml2ubuntu-pro-upgrade-python-libxml2ubuntu-pro-upgrade-python3-libxml2ubuntu-upgrade-libxml2ubuntu-upgrade-python3-libxml2 | Apr 29, 2025 | Apr 17, 2025 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jul 2, 2025 | Apr 17, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub