Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2

Summary

A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.

Timeline

1. Jun 12, 2025, 12:49 PM UTCCVE published
2. Sep 3, 2025, 2:41 PM UTCCISA SSVC assessment

   Exploitation: poc · Automatable: yes · Technical impact: partial

3. Oct 12, 2026, 8:14 PM UTCRecord last updated

Affected versions

• libxml2

  fixed in 2.14.4

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• openshift/ose-rhel-coreos-8

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• discovery/discovery-server-rhel9

  Version range not reported

• libxml2-main

  Version range not reported

• insights-proxy/insights-proxy-container-rhel9

  Version range not reported

• libxml2

  Version range not reported

• javaBitnami

  fixed in 1.8.0; From 1.9.0 · fixed in 8.0.481

• java-minBitnami

  fixed in 1.8.0; From 1.9.0 · fixed in 8.0.481

• jreBitnami

  fixed in 1.8.0; From 1.9.0 · fixed in 8.0.481

References 25