Search/CVE-2025-32415
● CVE — Low

CVE-2025-32415

VendorxmlsoftProductlibxml2DiscoveredApr 17, 2025UpdatedNov 3, 2025

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.

View graph Watch Export
CVSS v3.1
2.9 LOW
EPSS
0.59%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
1
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Oct 22, 2026
▼ 0.01pp
0.60% → 0.59% over 4 tracked changes
CVSS v3.1 Detail
Attack VectorLOCAL
Attack ComplexityHIGH
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityNONE
IntegrityNONE
AvailabilityLOW
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Connections
3 relationships
Timeline
disclosure → media coverage
Apr 17, 2025
Disclosure — published as a CVE record. · last revised by NVD Nov 3, 2025
Nov 27, 2025
ubuntu.com reports: USN-7896-1: libxml2 vulnerabilities