EUVD-2025-18175CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5Description
A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.
Analysis
CVE-2025-6021 is an integer overflow vulnerability in libxml2's xmlBuildQName function that can trigger a stack-based buffer overflow when processing specially crafted XML input. This affects all libxml2 users and downstream applications (web servers, parsers, document processors) that process untrusted XML content; attackers can cause denial of service through memory corruption. The vulnerability is remotely exploitable with no authentication required, though current KEV/active exploitation status is unknown without extended intelligence sources.
Technical Context
libxml2 is a ubiquitous XML processing library used across Linux distributions, web browsers, web servers, and countless applications. The xmlBuildQName function constructs qualified XML names (namespace prefixes + local names). The root cause (CWE-190: Integer Overflow or Wraparound) occurs in buffer size calculations—when computing the combined length of prefix and local name, integer arithmetic can overflow, causing the calculated size to be smaller than the actual buffer needed. This results in a stack-based buffer overflow when data is written beyond allocated bounds. Affected CPE likely includes libxml2 versions prior to a patch release (commonly cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*), and transitively, products bundling vulnerable versions (Apache httpd, PHP, Python, Node.js XML modules, etc.).
Affected Products
libxml2 (all versions prior to patched release—exact version TBD pending vendor advisory; typically affects 2.x branch up to a specific cutoff). Downstream affected products include: Apache httpd (with XML modules), PHP (libxml2 binding), Python (lxml, xml modules), Node.js (xml2js, libxmljs), Ruby (nokogiri), GNOME libraries, ImageMagick, poppler, and any application statically/dynamically linking libxml2. CPE template: cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* (version constraint pending patch release). Vendor advisory from xmlsoft.org/security or GNOME security tracker should be consulted for exact patched versions and affected branches.
Remediation
Immediate actions: (1) Monitor xmlsoft.org security advisories and GNOME security tracker for official patch release and patched version numbers (likely 2.x.y with increment). (2) Update libxml2 to patched version across all systems (via distro package manager: apt, yum, brew, etc.). (3) For applications with embedded/vendored libxml2, rebuild and redeploy with updated library. (4) Short-term mitigation if patch unavailable: restrict XML input processing to trusted sources only; implement input validation and size limits before parsing; consider sandboxing XML processing in containers or separate processes. (5) Validate patch via checksums from official xmlsoft.org source. Once patched version is released (estimated within days-weeks of CVE publication), apply universally to production systems, especially internet-facing XML parsers, web services, and document processors.
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| bionic | released | 2.9.4+dfsg1-6.1ubuntu1.9+esm4 |
| focal | released | 2.9.10+dfsg-5ubuntu0.20.04.10+esm1 |
| jammy | released | 2.9.13+dfsg-1ubuntu0.8 |
| noble | released | 2.9.14+dfsg-1.3ubuntu3.4 |
| plucky | released | 2.12.7+dfsg+really2.9.14-0.4ubuntu0.2 |
| trusty | released | 2.9.1+dfsg1-3ubuntu4.13+esm8 |
| upstream | released | - |
| xenial | released | 2.9.3+dfsg1-1ubuntu0.7+esm9 |
| oracular | ignored | end of life, was needs-triage |
Debian
Bug #1107720| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 2.9.10+dfsg-6.7+deb11u8 | - |
| bullseye (security) | fixed | 2.9.10+dfsg-6.7+deb11u9 | - |
| bookworm | fixed | 2.9.14+dfsg-1.3~deb12u3 | - |
| bookworm (security) | fixed | 2.9.14+dfsg-1.3~deb12u4 | - |
| trixie | fixed | 2.12.7+dfsg+really2.9.14-2.1+deb13u2 | - |
| trixie (security) | fixed | 2.12.7+dfsg+really2.9.14-2.1+deb13u1 | - |
| forky, sid | fixed | 2.15.1+dfsg-2 | - |
| (unstable) | fixed | 2.12.7+dfsg+really2.9.14-2 | - |
Share
External POC / Exploit Code
Leaving vuln.today