CVE-2025-32414: High severity Gnome libxml2 vulnerability
In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libxml2to a version that resolves this vulnerability.Fixed in 2.9.14+dfsg-1.3~deb12u6Fixed in 2.9.14+dfsg-1.3~deb12u4Fixed in 2.12.7+dfsg+really2.9.14-2.1+deb13u3Fixed in 2.12.7+dfsg+really2.9.14-2.1+deb13u1Fixed in 2.15.4+dfsg-1 - Upgrade
Upgrade
libxml2to a version that resolves this vulnerability.Fixed in 2.13.8 - Upgrade
Upgrade
libxml2to a version that resolves this vulnerability.Fixed in 2.14.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32414?
CVE-2025-32414 has been classified as a high severity vulnerability due to the potential for out-of-bounds memory access.
How do I fix CVE-2025-32414?
To resolve CVE-2025-32414, upgrade libxml2 to version 2.13.8 or version 2.14.2 or later.
What versions of libxml2 are affected by CVE-2025-32414?
CVE-2025-32414 affects libxml2 versions prior to 2.13.8 and those in the 2.14.x series up to 2.14.1.
What components of libxml2 are impacted by CVE-2025-32414?
The vulnerability in CVE-2025-32414 specifically impacts the Python API, particularly the xmlPythonFileRead and xmlPythonFileReadRaw functions.
Is CVE-2025-32414 exploitable in production environments?
Yes, CVE-2025-32414 could be exploited in production environments, potentially leading to application crashes or unexpected behavior.