Cyber Resilience

CVE-2025-32415

Memory Safety in Xmlsoft Libxml2 ≤ 2.13.8

Public PoCMemory Safety
Published
17 April 2025
Modified
17 June 2026
CVSS Score v3.1 2.9
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score 0.0060 45th percentile
Risk Priority 15 floored blend · peak EPSS

Summary

CVE-2025-32415 is a low-severity Improper Validation of Specified Quantity in Input (CWE-1284) vulnerability in Xmlsoft Libxml2. Its CVSS base score is 2.9 (Low).

Operationally, ranked at the 45th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must…

more

be used.

CWE(s)

Related Threats

CVEs Like This One

CVE-2026-11979Same product: Xmlsoft Libxml2
CVE-2025-27113Same product: Xmlsoft Libxml2
CVE-2023-39615Same product: Xmlsoft Libxml2
CVE-2024-25062Same product: Xmlsoft Libxml2
CVE-2026-6653Same product: Xmlsoft Libxml2
CVE-2024-34459Same product: Xmlsoft Libxml2
CVE-2025-9714Same product: Xmlsoft Libxml2
CVE-2025-32414Same product: Xmlsoft Libxml2
CVE-2023-45322Same product: Xmlsoft Libxml2
CVE-2023-29469Same product: Xmlsoft Libxml2

Affected Assets

xmlsoft
libxml2
≤ 2.13.8 · 2.14.0 — 2.14.2

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SI-2 Flaw Remediation
  • SI-16 Memory Protection
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V6.7.2
  • V1.4.2
  • V2.1.1
  • V2.2.1

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation of XML input quantity/structure to block the crafted schema/identity-constraint documents that trigger the under-read.

prevent

Mandates timely patching of libxml2 to the fixed versions (2.13.8/2.14.2) that eliminate the heap under-read in xmlSchemaIDCFillNodeTables.

prevent

Provides memory-protection mechanisms that can contain or block exploitation of the out-of-bounds read before it produces a crash or disclosure.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require proper quantity/length validation in input handling.

ID.RA-01 partial match
prevents

Vulnerability scanning and recording can discover instances of out-of-bounds reads after code is deployed.

PR.PS-02 partial match
prevents

Routine patching replaces vulnerable code containing out-of-bounds read flaws.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development can detect missing quantity validation but does not itself implement the control.

A.8.15 Logging partial match
detects

Logging can record evidence of an out-of-bounds read but does not prevent the weakness itself.

prevents

Secure development lifecycle mandates input validation for quantity fields, directly preventing CWE-1284.

prevents

Application security requirements explicitly call for validation of size/length inputs, mitigating CWE-1284.

prevents

Secure architecture principles encourage robust input handling but do not specifically address quantity validation.

prevents

Secure coding standards require explicit checks on numeric quantity inputs, fully addressing CWE-1284.

References