Read the docs
TI-2025-23491 Aliases CVE-2025-32415GHSA-w8fw-fj9q-vcjj

Out-of-bounds read in xmlsoft libxml2

Priority HIGH 66CWE-1284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 45 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.

Summary

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0059 48th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial libxml2 (xmlsoft): 2.13.8, 2.14.2Red Hat: 25 advisoriesRed Hat: 45 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
xmlsoftlibxml2before 2.13.8; 2.14.0 to before 2.14.22.13.8, 2.14.2Patch availableCNA
  • libxml2 Vendorxmlsoft Affected before 2.13.8; 2.14.0 to before 2.14.2 Fixed in 2.13.8, 2.14.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*before 2.13.8; 2.14.0 to before 2.14.2Vulnerablexmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* Versions before 2.13.8; 2.14.0 to before 2.14.2 Vulnerable ·xmlsoft

Remediation

  • Fix · CNA libxml2 (xmlsoft) Fixed in 2.13.8, 2.14.2

Red Hat 25 advisories

  • RHSA-2026:7519 Released 2026-04-10 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images libxml2-16-2.15.2-0.3.hum1@aarch64, libxml2-16-2.15.2-0.3.hum1@x86_64, libxml2-2.15.2-0.3.hum1@aarch64 +8
  • RHSA-2025:22529 Released 2025-12-01 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 7 registry.redhat.io/rhceph/rhceph-7-rhel9
  • RHSA-2025:16159 Released 2025-09-25 · Red Hat rating Moderate
    OpenShift Container Platform 4.15.58 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 rhcos-aarch64-415.92.202509170209-0, rhcos-ppc64le-415.92.202509170209-0, rhcos-s390x-415.92.202509170209-0 +1
Show 22 more Red Hat advisories
  • RHSA-2025:15672 Released 2025-09-18 · Red Hat rating Important
    OpenShift Container Platform 4.13.60 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 rhcos-x86_64-413.92.202509030117-0
  • RHSA-2025:15308 Released 2025-09-11 · Red Hat rating Important
    OpenShift Container Platform 4.12.80 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 rhcos-x86_64-412.86.202509030110-0
  • RHSA-2025:14858 Released 2025-09-04 · Red Hat rating Important
    OpenShift Container Platform 4.16.47 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 rhcos-aarch64-416.94.202508261955-0, rhcos-ppc64le-416.94.202508261955-0, rhcos-s390x-416.94.202508261955-0 +1
  • RHSA-2025:14853 Released 2025-09-04 · Red Hat rating Important
    OpenShift Container Platform 4.14.56 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 rhcos-aarch64-414.92.202508270040-0, rhcos-ppc64le-414.92.202508270040-0, rhcos-s390x-414.92.202508270040-0 +1
  • RHSA-2025:14818 Released 2025-09-04 · Red Hat rating Important
    OpenShift Container Platform 4.18.23 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 rhcos-aarch64-418.94.202508261658-0, rhcos-ppc64le-418.94.202508261658-0, rhcos-s390x-418.94.202508261658-0 +1
  • RHSA-2025:14819 Released 2025-09-02 · Red Hat rating Important
    OpenShift Container Platform 4.19.10 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 rhcos-aarch64-4.19.9.6.202508271124-0, rhcos-ppc64le-4.19.9.6.202508271124-0, rhcos-s390x-4.19.9.6.202508271124-0 +1
  • RHSA-2025:14059 Released 2025-08-27 · Red Hat rating Important
    OpenShift Container Platform 4.17.38 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 rhcos-aarch64-417.94.202508141510-0, rhcos-ppc64le-417.94.202508141510-0, rhcos-s390x-417.94.202508141510-0 +1
  • RHSA-2025:14644 Released 2025-08-26 · Red Hat rating Important
    Insights proxy Container Image
    • Red Hat Insights proxy 1.5 registry.redhat.io/insights-proxy/insights-proxy-container-rhel9
  • RHSA-2025:14186 Released 2025-08-20 · Red Hat rating Moderate
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9
  • RHSA-2025:13681 Released 2025-08-14 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP1 security update
    • Red Hat JBoss Core Services 2.4.62.SP1
  • RHSA-2025:13806 Released 2025-08-13 · Red Hat rating Moderate
    libxml2 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) libxml2-devel-2.9.7-16.el8_8.12
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) libxml2-devel-2.9.7-16.el8_8.12
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) libxml2-2.9.7-16.el8_8.12, python3-libxml2-2.9.7-16.el8_8.12
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) libxml2-2.9.7-16.el8_8.12, python3-libxml2-2.9.7-16.el8_8.12
  • RHSA-2025:13789 Released 2025-08-13 · Red Hat rating Moderate
    libxml2 security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) libxml2-2.9.1-6.el7_9.13, libxml2-2.9.1-6.el7_9.13.ppc, libxml2-devel-2.9.1-6.el7_9.13 +2
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) libxml2-static-2.9.1-6.el7_9.13, libxml2-static-2.9.1-6.el7_9.13.ppc
  • RHSA-2025:13788 Released 2025-08-13 · Red Hat rating Moderate
    libxml2 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) libxml2-devel-2.9.7-9.el8_4.8
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) libxml2-devel-2.9.7-9.el8_4.8
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) libxml2-2.9.7-9.el8_4.8, python3-libxml2-2.9.7-9.el8_4.8
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) libxml2-2.9.7-9.el8_4.8, python3-libxml2-2.9.7-9.el8_4.8
  • RHSA-2025:13688 Released 2025-08-12 · Red Hat rating Moderate
    libxml2 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) libxml2-devel-2.9.7-13.el8_6.12
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) libxml2-devel-2.9.7-13.el8_6.12
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) libxml2-devel-2.9.7-13.el8_6.12
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) libxml2-2.9.7-13.el8_6.12, python3-libxml2-2.9.7-13.el8_6.12
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) libxml2-2.9.7-13.el8_6.12, python3-libxml2-2.9.7-13.el8_6.12
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) libxml2-2.9.7-13.el8_6.12, python3-libxml2-2.9.7-13.el8_6.12
  • RHSA-2025:13689 Released 2025-08-12 · Red Hat rating Moderate
    libxml2 security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) libxml2-devel-2.9.7-9.el8_2.5
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) libxml2-2.9.7-9.el8_2.5, python3-libxml2-2.9.7-9.el8_2.5
  • RHSA-2025:13683 Released 2025-08-12 · Red Hat rating Moderate
    libxml2 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) libxml2-devel-2.9.13-3.el9_2.9
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) libxml2-2.9.13-3.el9_2.9, python3-libxml2-2.9.13-3.el9_2.9
  • RHSA-2025:13684 Released 2025-08-12 · Red Hat rating Moderate
    libxml2 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) libxml2-devel-2.9.13-1.el9_0.7
    • Red Hat Enterprise Linux BaseOS E4S (v.9.0) libxml2-2.9.13-1.el9_0.7, python3-libxml2-2.9.13-1.el9_0.7
  • RHSA-2025:13677 Released 2025-08-12 · Red Hat rating Moderate
    libxml2 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) libxml2-devel-2.9.13-12.el9_4
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) libxml2-2.9.13-12.el9_4, python3-libxml2-2.9.13-12.el9_4
  • RHSA-2025:13622 Released 2025-08-11 · Red Hat rating Important
    Red Hat OpenShift distributed tracing platform (Jaeger) 3.5.2 release
    • Red Hat OpenShift distributed tracing 3.5.3 registry.redhat.io/rhosdt/jaeger-agent-rhel8, registry.redhat.io/rhosdt/jaeger-all-in-one-rhel8, registry.redhat.io/rhosdt/jaeger-collector-rhel8 +6
  • RHSA-2025:13428 Released 2025-08-07 · Red Hat rating Moderate
    libxml2 security update
    • Red Hat Enterprise Linux AppStream (v. 9) libxml2-devel-2.9.13-12.el9_6
    • Red Hat Enterprise Linux BaseOS (v. 9) libxml2-2.9.13-12.el9_6, python3-libxml2-2.9.13-12.el9_6
  • RHSA-2025:13429 Released 2025-08-07 · Red Hat rating Moderate
    libxml2 security update
    • Red Hat Enterprise Linux AppStream (v. 10) libxml2-devel-2.12.5-9.el10_0
    • Red Hat Enterprise Linux BaseOS (v. 10) libxml2-2.12.5-9.el10_0, python3-libxml2-2.12.5-9.el10_0
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libxml2-static-2.12.5-9.el10_0
  • RHSA-2025:13203 Released 2025-08-06 · Red Hat rating Moderate
    libxml2 security update
    • Red Hat Enterprise Linux AppStream (v. 8) libxml2-devel-2.9.7-21.el8_10.3
    • Red Hat Enterprise Linux BaseOS (v. 8) libxml2-2.9.7-21.el8_10.3, python3-libxml2-2.9.7-21.el8_10.3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 7Fixed RHSA-2025:22529
Red Hat Discovery 2Fixed RHSA-2025:14186
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:13429
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:13203
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:13428
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2025:13689
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2025:13788
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2025:13688
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2025:13688
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2025:13806
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2025:13684
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2025:13683
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:13677
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2025:13788
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2025:13688
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2025:13806
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2025:13429
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2025:13203
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2025:13428
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2025:13689
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2025:13788
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2025:13688
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2025:13688
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2025:13806
Red Hat Enterprise Linux BaseOS E4S (v.9.0)Fixed RHSA-2025:13684
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2025:13683
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2025:13677
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2025:13788
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2025:13688
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2025:13806
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2025:13429
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2025:13789
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2025:13789
Red Hat Hardened ImagesFixed RHSA-2026:7519
Red Hat Insights proxy 1.5Fixed RHSA-2025:14644
Red Hat JBoss Core Services 2.4.62.SP1Fixed RHSA-2025:13681
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2025:15308
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2025:15672
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2025:14853
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2025:16159
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2025:14858
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2025:14059
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2025:14818
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2025:14819
Red Hat OpenShift distributed tracing 3.5.3Fixed RHSA-2025:13622
Not affected: 2 products
  • Red Hat Ceph Storage 7
  • Red Hat Discovery 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-32415
  2. 2026-10-03 Alias added: GHSA-w8fw-fj9q-vcjj
  3. 2026-10-09 Fix available: RHSA-2025:13681 · Red Hat
  4. 2026-10-21 Fix available: Red Hat JBoss Core Services 2.4.62.SP1 · Red Hat

References

Exploit 1

  • TI-2020-06117 xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. CVSS 3.1HIGH 7.5
  • TI-2025-05441 Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2 CVSS 3.1HIGH 7.5
  • TI-2024-22792 An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. CVSS 3.1HIGH 7.5
  • TI-2017-06514 libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the… CVSS 3.1HIGH 7.5
  • TI-2022-19140 An issue was discovered in libxml2 before 2.10.3. CVSS 3.1HIGH 7.5
  • TI-2025-23490 In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur… CVSS 3.1HIGH 7.5
See all 114 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences