CVE-2025-32415

xmlsoft / libxml2 PUBLISHED

Description (CNA)

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.

Affected (CNA)

Vendor / product	Versions
xmlsoft / libxml2	affected 0 before 2.13.8; affected 2.14.0 before 2.14.2

CWE

CWE-1284

References

https://gitlab.gnome.org/GNOME/libxml2/-/issues/890

ADP enrichment

CISA-ADP

No English description supplied.

https://gitlab.gnome.org/GNOME/libxml2/-/issues/890

CVE

No English description supplied.

https://lists.debian.org/debian-lts-announce/2025/04/msg00041.html