CVE-2025-32415

What it actually does

Heap-based buffer under-read in xmlSchemaIDCFillNodeTables during XML schema validation with identity constraints, allowing out-of-bounds memory access when processing crafted XML documents or schemas.

Why it matters to the business

Applications processing untrusted XML schemas or documents may crash or leak sensitive memory contents, leading to service disruption and potential exposure of internal data; high ecosystem prevalence increases patching urgency across dependent systems.

How an attack unfolds

An attacker crafts a malicious XML document or schema containing specific identity constraints and supplies it to an application that performs schema validation with libxml2; the vulnerable function then performs an under-read on the heap during node table population.

How to fix it

Upgrade libxml2 to 2.13.8 or 2.14.2 or later; for affected Red Hat Enterprise Linux 8 packages apply mpg123 1.32.9-1.el8_10 or newer; apply the libxml2 commit eb0a2f2b91566384f378d870ffcd69c0a24162cc where source builds are used.

How to confirm the fix worked

Confirm installed libxml2 version meets or exceeds 2.13.8/2.14.2; re-run schema validation test cases with previously crashing inputs; monitor for absence of under-read crashes in validation paths.

Typical attack path

1. Identify target application accepting XML input with schema validation
2. Craft XML document or schema triggering identity constraint path in xmlschemas.c
3. Submit input to trigger xmlSchemaIDCFillNodeTables under-read
4. Observe crash for denial of service or inspect leaked heap memory for sensitive data

How to detect it

Review application logs for unexpected crashes or errors during XML schema validation; search process memory dumps or core files for patterns consistent with heap under-reads after XML processing; no public exploitation artifacts are known.

What your security team should do

• Prioritize patching libxml2 in all environments handling XML schema validation due to 559 days since publication
• Inventory and update all dependent packages including mpg123 on Red Hat Enterprise Linux 8
• Disable schema validation for untrusted inputs until patches are applied
• Add XML input sanitization and size limits as defense-in-depth