CVE-2025-32414

What it actually does

Out-of-bounds memory access in libxml2 Python bindings triggered by incorrect return value handling in xmlPythonFileRead and xmlPythonFileReadRaw due to bytes-versus-characters mismatch.

Why it matters to the business

Applications using the libxml2 Python API on affected systems may experience crashes, memory corruption, or potential remote code execution, leading to service disruption and increased remediation costs across dependent packages.

How an attack unfolds

An attacker supplies input that exercises the Python file read paths in libxml2, causing the incorrect return value to be used and resulting in out-of-bounds access; no named threat actors or campaigns are associated with this issue.

How to fix it

Upgrade libxml2 to 2.13.8 or 2.14.2 or later; for the listed Red Hat packages apply the updates to openssl 1:1.1.1c-21.el8_2 and for gnome/libxml2 apply commit eb0a2f2b91566384f378d870ffcd69c0a24162cc.

How to confirm the fix worked

Confirm the installed libxml2 version is at or above the fixed releases and test that Python bindings no longer exhibit the return-value mismatch on crafted input.

Typical attack path

1. Identify an application that uses libxml2 Python bindings to parse or read XML content
2. Craft or supply malicious input that reaches xmlPythonFileRead or xmlPythonFileReadRaw
3. Trigger the bytes/characters mismatch to induce out-of-bounds memory access
4. Leverage resulting memory corruption for denial of service or code execution

How to detect it

Review application logs and Python traceback entries for errors originating from xmlPythonFileRead or xmlPythonFileReadRaw; inspect process memory dumps for out-of-bounds access patterns after XML parsing operations.

What your security team should do

• Prioritize patching libxml2 in environments with Python bindings in use
• Scan for and update all listed Red Hat openssl and gnome/libxml2 packages to the specified fixed versions
• Monitor EPSS trend and reassess if exploit maturity increases