In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.
CVSS Details
- CVSS 3.1 Base Score: 2.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libxml2Upgrade python3-libxml2Upgrade libxml2-devel | Aug 7, 2025 | Aug 6, 2025 |
| Alpine Linux | — | Upgrade libxml2 | Aug 8, 2025 | Apr 17, 2025 |
| Amazon Linux Ami 2 | — | Upgrade libxml2-develUpgrade libxml2-debuginfoUpgrade libxml2-pythonUpgrade libxml2Upgrade libxml2-static | May 30, 2025 | Apr 17, 2025 |
| Amazon_linux_2023 | — | Upgrade libxml2-develUpgrade libxml2-debuginfoUpgrade python3-libxml2Upgrade libxml2-staticUpgrade libxml2Upgrade python3-libxml2-debuginfoUpgrade libxml2-debugsource | May 14, 2025 | Apr 17, 2025 |
| Debian | — | Upgrade libxml2 | May 2, 2025 | Apr 17, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-libxml2Upgrade libxml2 | Jul 11, 2025 | Apr 17, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade python3-libxml2Upgrade libxml2 | Jun 13, 2025 | Apr 17, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-libxml2Upgrade libxml2 | Jul 21, 2025 | Apr 17, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade libxml2Upgrade python3-libxml2 | Aug 13, 2025 | Jun 12, 2025 |
| Ibm Aix | — | Apply the fix or workaround for libxml2_advisory8 | Jun 5, 2025 | Apr 17, 2025 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 10, 2025 |
| Oracle_linux | — | Upgrade libxml2-pythonUpgrade libxml2-staticUpgrade libxml2Upgrade libxml2-develUpgrade python3-libxml2 | Aug 12, 2025 | Apr 17, 2025 |
| Redhat Openshift | — | Upgrade rhcos | Aug 10, 2026 | Apr 17, 2025 |
| Redhat_linux | — | Upgrade libxml2-debugsourceUpgrade libxml2Upgrade python3-libxml2-debuginfoUpgrade libxml2-develUpgrade python3-libxml2No solution existsUpgrade libxml2-debuginfoUpgrade libxml2-staticUpgrade libxml2-python | Jul 9, 2025 | Apr 17, 2025 |
| Rocky_linux | — | Upgrade libxml2-debugsourceUpgrade libxml2Upgrade libxml2-develUpgrade libxml2-debuginfoUpgrade python3-libxml2Upgrade python3-libxml2-debuginfoUpgrade libxml2-static | Feb 5, 2026 | Oct 3, 2025 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.2.8Upgrade Splunk Enterprise to version 10.0.1Upgrade Splunk Enterprise to version 9.3.6Upgrade Splunk Enterprise to version 9.4.4 | Oct 6, 2025 | Apr 17, 2025 |
| Suse | — | Upgrade libxml2-2Upgrade python313-libxml2Upgrade python311-libxml2Upgrade python3-libxml2Upgrade python-libxml2Upgrade libxml2-2-32bitUpgrade libxml2-docUpgrade libxml2-develUpgrade libxml2-devel-32bitUpgrade python3-libxml2-pythonUpgrade libxml2-tools | Dec 5, 2025 | Aug 7, 2025 |
| Ubuntu | — | Upgrade libxml2Upgrade python3-libxml2 (Ubuntu Pro)Upgrade python-libxml2 (Ubuntu Pro)Upgrade libxml2 (Ubuntu Pro)Upgrade python3-libxml2 | Apr 29, 2025 | Apr 17, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Apr 17, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub