Raptor RDF CVE-2025-71436

Exploitation requires that the target application use Raptor 2.0.15 or 2.0.16 to parse an attacker-supplied RDF document in Turtle, TriG, N-Triples, or N-Quads format, and that the document contain a literal whose language tag is 256 bytes or longer - this oversized tag is the exact trigger. The limiting factor is UI:P: an attacker cannot reach the code path without the victim (or a service on the victim's behalf) actually feeding the malicious document through Raptor's parser, so exposure depends on whether the deployment ingests untrusted RDF. No special non-default configuration is required beyond invoking the affected parsers, which are core library functionality.

This is a genuine but moderate-priority memory-corruption flaw (CWE-122 heap-based buffer overflow). The vendor-supplied CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) scores 7.1 and correctly reflects that no authentication is needed but that exploitation hinges on the victim parsing attacker-controlled input (UI:P - passive user interaction). Impact is weighted toward availability (VA:H, i.e. reliable application crash) with only limited integrity impact (VI:L) and no confidentiality impact (VC:N), which is consistent with the description's framing of code execution as 'possibly' rather than demonstrated. Supporting signals are thin: no EPSS score was provided, the CVE is NOT on CISA KEV, and no POC flag is present in the intelligence - so by the precision rules this is 'no public exploit identified at time of analysis.' The one amplifying signal is that it was reported by VulnCheck (a credible exploitation-intelligence vendor) and a vendor patch exists with a source-level fix and regression tests, confirming the root cause. Net: a real, patch-now-if-exposed bug for anything that parses untrusted RDF, but not an emergency - no evidence of active exploitation and the realistic outcome is denial of service rather than confirmed RCE. Conflict to verify: the description says 'possibly execute code' while the vendor scored only VI:L/VC:N, so the code-execution claim is not reflected as high impact in the official vector - treat RCE as unproven.

An application built on Raptor (e.g. an RDF ingestion service, triple-store loader, or semantic-web tool) accepts a Turtle, TriG, N-Triples, or N-Quads document from an untrusted source. An attacker submits a document containing a literal with a language tag of 256 bytes or longer; the length is truncated to an unsigned char in raptor_new_term_from_counted_literal(), causing an undersized heap allocation and overflow that crashes the process and could potentially corrupt adjacent heap structures. No public exploit was identified in the provided data, so weaponization effort is unknown.