CVE-2025-71346 in Nokogiri
Summary
by MITRE • 08/25/2026
Nokogiri before 1.18.8 packages a vulnerable version of libxml2 (before 2.13.8) that contains a heap-based buffer under-read (CVE-2025-32415) in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The issue can be triggered when validating against an untrusted XML Schema, or when validating untrusted documents against trusted schemas that use xsd:keyref in combination with recursively defined types that have additional identity constraints. Upstream and MITRE rate this issue as low severity.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified as CVE-2025-32415 represents a heap-based buffer under-read within the libxml2 library, specifically located in the xmlSchemaIDCFillNodeTables function found in the xmlschemas.c source file. This flaw is intrinsic to the XML Schema validation logic and manifests when Nokogiri versions prior to 1.18.8 are utilized, as they bundle a vulnerable iteration of libxml2 earlier than version 2.13.8. The core technical deficiency involves an off-by-one error or similar boundary miscalculation during the processing of identity constraints within XML schemas. When the parser attempts to fill node tables for schema validation, it accesses memory addresses preceding the intended buffer start point rather than exceeding its end, which classifies this as a read-based vulnerability rather than a write-based one like typical heap overflows.
The operational impact of this vulnerability is primarily realized during the parsing and validation phases of XML documents against XSD schemas. Attackers can trigger this condition by providing an untrusted XML Schema that contains recursively defined types coupled with additional identity constraints, specifically utilizing xsd:keyref elements in combination with recursive structures. Alternatively, the flaw can be exploited when validating untrusted input documents against trusted schemas if those schemas employ these specific complex type definitions. The immediate consequence of triggering a heap-based buffer under-read is often an application crash due to segmentation faults or access violations, leading to a denial of service condition for services relying on Nokogiri for XML processing. In more sophisticated scenarios involving memory corruption patterns that follow the initial read, there may be potential implications for information disclosure if sensitive data resides in adjacent lower-memory regions, although such exploitation is generally considered difficult and less likely than simple crash-based attacks.
From a threat modeling perspective, this vulnerability aligns with CWE-125 Out-of-bounds Read, which describes accessing memory beyond the bounds of an allocated buffer. The attack vector falls under ATT&CK technique T1068 Exploitation for Privilege Escalation if the read allows bypassing security checks, but more commonly it maps to T1499 Endpoint Denial of Service when used to crash applications. Despite these potential impacts, both upstream maintainers and MITRE have rated this issue as low severity. This classification reflects the difficulty in reliably exploiting a heap under-read for arbitrary code execution compared to write-based vulnerabilities, as well as the specific conditions required involving complex schema structures that may not be present in all use cases of Nokogiri or libxml2.
Mitigation strategies focus on immediate version updates and defensive coding practices. The primary remediation is to upgrade Nokogiri to version 1.18.8 or later, which incorporates a patched version of libxml2 where the xmlSchemaIDCFillNodeTables function has been corrected to properly validate buffer boundaries before accessing memory. Organizations should also audit their XML processing pipelines for untrusted schema inputs and implement strict allow-listing of XSD files if possible. Additionally, enabling Address Sanitizer tools during development can help detect such off-by-one errors early in the software lifecycle. For environments where immediate patching is not feasible, input validation mechanisms that restrict the complexity of recursive types or identity constraints in incoming schemas may provide a partial mitigation layer against triggering this specific code path.