Heap-based buffer overflow in Libxml2 - CVE-2025-32415

Vulnerability identifier: #VU107596

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-32415

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the xmlSchemaIDCFillNodeTables() function. A remote attacker can pass specially crafted XML data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Libxml2
Debian Linux
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Anolis OS
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Ubuntu
Slackware Linux
Basesystem Module
Python 3 Module
openSUSE Leap
openEuler
Netezza Appliance
DataStage on Cloud Pak for Data
Netcool Operations Insight
EasyApache
IBM Power Hardware Management Console (HMC)
Red Hat Advanced Cluster Management for Kubernetes
Swagger UI
Oracle Banking Corporate Lending Process Management
Oracle Banking Origination
Nessus Network Monitor
Red Hat OpenShift Container Platform
Communications Unified Assurance
LANTIME Operating System Firmware (LTOS)
IBM Qradar SIEM
MySQL Workbench
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libxml2 (Ubuntu package)
python-libxml2 (Ubuntu package)
python3-libxml2 (Ubuntu package)
libxml2 (Red Hat package)
libxml2-static
libxml2
libxml2-devel
libxml2-python
libxml2-tools-debuginfo
libxml2-tools
libxml2-2-debuginfo-32bit
python-libxml2-debuginfo
libxml2-2-32bit
python-libxml2
libxml2-debugsource
libxml2-2
python-libxml2-debugsource
libxml2-doc
libxml2-2-debuginfo
python3-libxml2
python-libxml2-python-debugsource
python3-libxml2-python-debuginfo
python3-libxml2-python
libxml2-help
libxml2-debuginfo
python2-libxml2
libxml2 (Debian package)
libxml2-devel-64bit
python311-libxml2
python3-libxml2-debuginfo
libxml2-python-debugsource
python311-libxml2-debuginfo
libxml2-2-32bit-debuginfo
libxml2-devel-32bit
libxml2-2-64bit
libxml2-2-64bit-debuginfo
Splunk Enterprise
Red Hat OpenShift Serverless
Multicluster Engine for Kubernetes
OpenShift Virtualization
SmartFabric Manager
AMQ Broker

Install updates from vendor's website.

Libxml2 - addressed in versions 2.13.8, 2.14.2
Netezza Appliance - update to 1.0.0.1
Netcool Operations Insight - update to 1.6.15
EasyApache - update to 4 25-14
Swagger UI - update to 5.22.0
DataStage on Cloud Pak for Data - update to 5.2.1
Nessus Network Monitor - update to 6.5.1
LANTIME Operating System Firmware (LTOS) - update to 7.08.024
IBM Qradar SIEM - update to 7.5.0 Update Pack 13 IF01
Splunk Enterprise - addressed in versions 9.2.8, 9.3.6, 9.4.4, 10.0.1
IBM Power Hardware Management Console (HMC) - addressed in versions 10.3.1060.0 SP3, 11.1.1110.0
libxml2 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2.9.1+dfsg1-3ubuntu4.13+esm10, 2.9.10+dfsg-5ubuntu0.20.04.10, 2.9.13+dfsg-1ubuntu0.7, 2.9.14+dfsg-1.3ubuntu3.3, 2.12.7+dfsg-3ubuntu0.3, 2.12.7+dfsg+really2.9.14-0.4ubuntu0.1
python-libxml2 (Ubuntu package) - update to Ubuntu Pro
python3-libxml2 (Ubuntu package) - addressed in versions Ubuntu Pro, 2.9.10+dfsg-5ubuntu0.20.04.10, 2.9.13+dfsg-1ubuntu0.7, 2.9.14+dfsg-1.3ubuntu3.3, 2.12.7+dfsg-3ubuntu0.3, 2.12.7+dfsg+really2.9.14-0.4ubuntu0.1
Red Hat OpenShift Serverless - update to 1
SmartFabric Manager - update to 1.3.0
Multicluster Engine for Kubernetes - addressed in versions 2.7.6, 2.8.3
libxml2 (Red Hat package) - addressed in versions 2.9.1-6.el7_9.13, 2.9.7-9.el8_2.5, 2.9.7-9.el8_4.8, 2.9.7-13.el8_6.12, 2.9.7-16.el8_8.12, 2.9.7-21.el8_10.3, 2.9.13-1.el9_0.7, 2.9.13-3.el9_2.9, 2.9.13-12.el9_4, 2.9.13-12.el9_6, 2.12.5-9.el10_0
libxml2-static - update to 2.9.1-6.0.2
libxml2 - addressed in versions 2.9.1-6.0.2, 2.9.7-21.0.1
libxml2-devel - addressed in versions 2.9.1-6.0.2, 2.9.7-21.0.1
libxml2-python - update to 2.9.1-6.0.2
libxml2-tools-debuginfo - addressed in versions 2.9.4-46.84.1, 2.9.7-150000.3.79.1, 2.9.14-150400.5.41.1, 2.10.3-150500.5.26.1
libxml2-tools - addressed in versions 2.9.4-46.84.1, 2.9.7-150000.3.79.1, 2.9.14-150400.5.41.1, 2.10.3-150500.5.26.1
libxml2-2-debuginfo-32bit - update to 2.9.4-46.84.1
python-libxml2-debuginfo - update to 2.9.4-46.84.1
libxml2-2-32bit - addressed in versions 2.9.4-46.84.1, 2.9.14-150400.5.41.1, 2.10.3-150500.5.26.1
python-libxml2 - update to 2.9.4-46.84.1
libxml2-debugsource - addressed in versions 2.9.4-46.84.1, 2.9.7-150000.3.79.1, 2.9.14-150400.5.41.1, 2.10.3-150500.5.26.1
libxml2-2 - addressed in versions 2.9.4-46.84.1, 2.9.7-150000.3.79.1, 2.9.14-150400.5.41.1, 2.10.3-150500.5.26.1
python-libxml2-debugsource - update to 2.9.4-46.84.1
libxml2-doc - addressed in versions 2.9.4-46.84.1, 2.9.14-150400.5.41.1, 2.10.3-150500.5.26.1
libxml2-2-debuginfo - addressed in versions 2.9.4-46.84.1, 2.9.7-150000.3.79.1, 2.9.14-150400.5.41.1, 2.10.3-150500.5.26.1
libxml2-devel - addressed in versions 2.9.4-46.84.1, 2.9.14-150400.5.41.1, 2.10.3-150500.5.26.1
python3-libxml2 - update to 2.9.7-21.0.1
python-libxml2-python-debugsource - update to 2.9.7-150000.3.79.1
python3-libxml2-python-debuginfo - update to 2.9.7-150000.3.79.1
python3-libxml2-python - update to 2.9.7-150000.3.79.1
libxml2-debugsource - addressed in versions 2.9.10-44, 2.9.14-16, 2.11.5-6, 2.11.9-3
libxml2-devel - addressed in versions 2.9.10-44, 2.9.14-16, 2.11.5-6, 2.11.9-3
libxml2 - addressed in versions 2.9.10-44, 2.9.14-16, 2.11.5-6, 2.11.9-3
libxml2-help - addressed in versions 2.9.10-44, 2.9.14-16, 2.11.5-6, 2.11.9-3
python3-libxml2 - addressed in versions 2.9.10-44, 2.9.14-16, 2.11.5-6, 2.11.9-3
libxml2-debuginfo - addressed in versions 2.9.10-44, 2.9.14-16, 2.11.5-6, 2.11.9-3
python2-libxml2 - update to 2.9.10-44
libxml2 (Debian package) - update to 2.9.14+dfsg-1.3~deb12u2
libxml2-devel-64bit - addressed in versions 2.9.14-150400.5.41.1, 2.10.3-150500.5.26.1
python3-libxml2 - addressed in versions 2.9.14-150400.5.41.1, 2.10.3-150500.5.26.1
python311-libxml2 - addressed in versions 2.9.14-150400.5.41.1, 2.10.3-150500.5.26.1
python3-libxml2-debuginfo - addressed in versions 2.9.14-150400.5.41.1, 2.10.3-150500.5.26.1
libxml2-python-debugsource - addressed in versions 2.9.14-150400.5.41.1, 2.10.3-150500.5.26.1
python311-libxml2-debuginfo - addressed in versions 2.9.14-150400.5.41.1, 2.10.3-150500.5.26.1
libxml2-2-32bit-debuginfo - addressed in versions 2.9.14-150400.5.41.1, 2.10.3-150500.5.26.1
libxml2-devel-32bit - addressed in versions 2.9.14-150400.5.41.1, 2.10.3-150500.5.26.1
libxml2-2-64bit - addressed in versions 2.9.14-150400.5.41.1, 2.10.3-150500.5.26.1
libxml2-2-64bit-debuginfo - addressed in versions 2.9.14-150400.5.41.1, 2.10.3-150500.5.26.1
libxml2 - update to 2.11.9
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.12.5, 2.13.4
OpenShift Virtualization - update to 4.12.20
Red Hat OpenShift Container Platform - addressed in versions 4.12.80, 4.13.60, 4.14.56, 4.15.58, 4.16.47, 4.17.38, 4.18.23, 4.19.10
AMQ Broker - update to 7.13.2

• https://www.openwall.com/lists/oss-security/2025/04/17/3
• https://gitlab.gnome.org/GNOME/libxml2/-/issues/890

• Multiple vulnerabilities in libxml2
• Slackware Linux update for libxml2
• openEuler 24.03 LTS SP1 update for libxml2
• openEuler 24.03 LTS update for libxml2
• openEuler 22.03 LTS SP4 update for libxml2
• openEuler 22.03 LTS SP3 update for libxml2
• openEuler 20.03 LTS SP4 update for libxml2
• Ubuntu update for libxml2
• Ubuntu update for libxml2
• cPanel EasyApache4 update for third-party components
• SUSE update for libxml2
• SUSE update for libxml2
• SUSE update for libxml2
• SUSE update for libxml2
• Swagger UI update for libxml
• Multiple vulnerabilities in Tenable Network Monitor
• Dell SmartFabric Manager update for third-party components
• Meinberg LANTIME firmware update for third-party components
• Debian update for libxml2
• Multiple vulnerabilities in MySQL Workbench
• Red Hat Enterprise Linux 8 update for libxml2
• Red Hat Enterprise Linux 9 update for libxml2
• Red Hat Enterprise Linux 10 update for libxml2
• Anolis OS update for libxml2
• Red Hat Enterprise Linux 9 update for libxml2
• Red Hat Enterprise Linux 9 update for libxml2
• Red Hat Enterprise Linux 9 update for libxml2
• Red Hat Enterprise Linux 8 update for libxml2
• Red Hat Enterprise Linux 8 update for libxml2
• Red Hat Enterprise Linux 7 Extended Lifecycle Support update for libxml2
• Red Hat Enterprise Linux 8 update for libxml2
• Red Hat Enterprise Linux 8 update for libxml2
• Red Hat Enterprise Linux 8 update for libxml2
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.19
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.18
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in IBM DataStage on Cloud Pak for Data
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in OpenShift Virtualization 4.12
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.8
• Splunk Enterprise Security update for third-party components
• Multiple vulnerabilities in AMQ Broker 7.13
• Multiple vulnerabilities in Communications Unified Assurance
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.13
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.7
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.12
• Heap-based buffer overflow in Oracle Banking Corporate Lending Process Management
• Heap-based buffer overflow in Oracle Banking Origination
• IBM Power HMC update for libxml2
• Multiple vulnerabilities in Netcool Operations Insight
• Ubuntu update for libxml2
• IBM Netezza Appliance update for libxml2
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Anolis OS update for libxml2