In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.

🗓️ 27 May 2025 07:00:00Reported by MicrosoftType

Libxml2 heap under-read in xmlSchemaIDCFillNodeTables before 2.13.8 and 2.14.2 via crafted XML or schema.

Reporter	Title	Published	Views	Family All 279
IBM Security Bulletins	Security Bulletin: Vulnerability in libxml2 library (CVE-2025-32415) affects Power HMC.	19 Nov 202508:45	–	ibm
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to the libxml2 package (CVE-2025-27113, CVE-2025-32414, CVE-2025-32415)	2 Sep 202514:37	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images	5 Sep 202519:04	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in libxml2 affects IBM Netezza Appliance	17 Dec 202513:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues	7 Nov 202516:42	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in libxml2 affect AIX/VIOS	4 Jun 202515:05	–	ibm
Tenable Nessus	Amazon Linux 2023 : libxml2, libxml2-devel, libxml2-static (ALAS2023-2025-963)	13 May 202500:00	–	nessus
Tenable Nessus	Amazon Linux 2 : libxml2 (ALAS-2025-2860)	29 May 202500:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0136: libxml2 (ALINUX3-SA-2025:0136)	12 Aug 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : libxml2 (ALSA-2025:13203)	6 Aug 202500:00	–	nessus