xmlsoft libxml2 xmlBuildQName stack-based overflow

Summaryinfo

A vulnerability was found in xmlsoft libxml2. It has been declared as critical. Affected is the function xmlBuildQName. Executing a manipulation can lead to stack-based overflow. This vulnerability appears as CVE-2025-6021. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in xmlsoft libxml2 (version now known). It has been declared as critical. This vulnerability affects the function xmlBuildQName. The manipulation with an unknown input leads to a stack-based overflow vulnerability. The CWE definition for the vulnerability is CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.

The advisory is shared for download at bugzilla.redhat.com. This vulnerability was named CVE-2025-6021 since 06/12/2025. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/30/2025).

The vulnerability scanner Nessus provides a plugin with the ID 240319 (Amazon Linux 2023 : libxml2, libxml2-devel, libxml2-static (ALAS2023-2025-1019)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (240319), EUVD (EUVD-2025-18175) and CERT Bund (WID-SEC-2025-1312). Once again VulDB remains the best source for vulnerability data.

Affected

• IBM VIOS
• IBM AIX
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• Open Source Arch Linux
• IBM Power Hardware Management Console
• Red Hat OpenShift
• SUSE openSUSE
• Hitachi Energy RTU500
• IBM MQ
• NetApp Data ONTAP
• IBM TXSeries
• Open Source libxml2
• Tenable Security Nessus
• IBM App Connect Enterprise
• RealObjects PDFreactor
• Open Source Fluentd

Productinfo

Type

• Document Processing Software

Vendor

• xmlsoft

Name

• libxml2

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion