CVE-2025-32414: xmlsoft libxml2 Return of Wrong Status Code
CVSS: 7.5v3.1HighModified
AliasesALPINE-CVE-2025-32414RHSA-2025:8958UBUNTU-CVE-2025-32414DEBIAN-CVE-2025-32414CGA-c6w5-5qqh-v2xhCGA-c875-w7rq-6w9xCGA-27qf-q5x3-4mqqCGA-2v5j-5cqf-634hCGA-574r-gj69-7wqgCGA-65h2-vhgx-wx5mCGA-68rx-vv5f-rcvvCGA-6q99-6qj2-fh6gCGA-8q3j-5fc9-c7xwCGA-93qc-93gg-2xgmCGA-97h9-46rj-r4grCGA-9j8m-hm7g-v258CGA-9qpr-m4p9-43hxCGA-9wxp-gwc6-pccwCGA-ch2h-p973-g2whCGA-fv53-829v-v7v4CGA-g4p9-7fr7-f7rqCGA-hq87-97pq-xhqgCGA-jcc4-x85w-m2w5CGA-jfpr-5r77-qxm6CGA-m7rc-w7c3-xpmrCGA-mj65-5w77-fg9fCGA-mmh2-38x7-jj3vCGA-p686-53p5-c6j4CGA-p8hr-67cc-2wr7CGA-r6hm-9355-rfxvCGA-rmfw-mxxx-f365CGA-vg28-g5jq-ghw7CGA-vvrw-6v57-f2fjCGA-w635-p9mg-6j6qCGA-wqfc-5v5h-r7xgCGA-ww6g-w53m-rf4xCGA-x9jx-6cwq-35x6CGA-xgmf-p3pf-5gvc
Published 08-04-2025Last modified 03-11-2025
Vulnerability summary
CVE-2025-32414 is a high (CVSS 7.5) Return of Wrong Status Code vulnerability in xmlsoft libxml2. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
0.38%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 24 · Related 15DLA-4146-1DSA-5949-1MGASA-2025-0139OPENSUSE-SU-2025:15019-1RHSA-2025:12098RHSA-2025:12237RHSA-2025:12239RHSA-2025:12240RHSA-2025:12241RHSA-2025:13428RHSA-2025:13429RHSA-2025:13677RHSA-2025:13683RHSA-2025:13684RHSA-2026:7519SUSE-SU-2025:1435-1SUSE-SU-2025:1438-1SUSE-SU-2025:1439-1SUSE-SU-2025:1440-1SUSE-SU-2025:20333-1SUSE-SU-2025:20364-1USN-7467-1USN-7467-2USN-7896-1CGA-2R3H-67JM-GJX6CGA-CPV5-358X-QGVFCGA-MG6C-39CG-H6GCCGA-V78J-6C4W-P559CGA-X3G9-88VR-V4H5
Timeline
- 08-04-2025PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.
CVSS metrics
8 scores · 8 sources · 1 versionHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSources8 sources · 5.6–7.5
- CVE.orgCNA5.6MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:LDiffers
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · Red hatEcosystem advisory · calculated5.6MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated5.6MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:LDiffers
- OSV · ChainguardEcosystem advisory · calculated5.6MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:LDiffers
EPSS trend
Probability
0.38%
Chance of exploitation in the next 30 days
Percentile
30%
Versus all other CVEs
30-day change
+0.01 pp
From 0.37% on 18-09-2026
18-09-202618-10-2026
EPSS score0.38%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (gitlab.gnome.org)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-393Return of Wrong Status CodeA function or operation returns an incorrect return value or status code that does not indicate the true result of execution, causing the product to modify its behavior based on the incorrect result.
- CWE-252Unchecked Return ValueThe product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
Affected systems
Chainguard17 products
- openjdk-11-openj9-default-policy< 0.53.0-r0
- openjdk-17-openj9-default-policy< 0.53.0-r0
- openjdk-21-openj9-default-policy< 0.53.0-r0
- openjdk-25-openj9< 0.59.0-r1
- openjdk-25-openj9-dbg< 0.59.0-r1
Redhat6 products
- libxml2< 0:2.9.7-20.el8_10
- libxml2-debuginfo< 0:2.9.7-20.el8_10
- libxml2-debugsource< 0:2.9.7-20.el8_10
- libxml2-devel< 0:2.9.7-20.el8_10
- python3-libxml2< 0:2.9.7-20.el8_10
Alpine1 product
- libxml2≥ 2.14.0, < 2.11.8-r3 | ≥ 2.14.0, < 2.12.10-r0 | ≥ 2.14.0, < 2.13.4-r6 | ≥ 2.14.0, < 2.13.8-r0
Debian1 product
- libxml2< 2.9.14+dfsg-1.3~deb12u2 | < 2.12.7+dfsg+really2.9.14-1
Ubuntu1 product
- libxml2< 2.9.1+dfsg1-3ubuntu4.13+esm10 | < 2.9.3+dfsg1-1ubuntu0.7+esm8 | < 2.9.4+dfsg1-6.1ubuntu1.9+esm3 | < 2.9.10+dfsg-5ubuntu0.20.04.10 | < 2.9.13+dfsg-1ubuntu0.7 | < 2.9.14+dfsg-1.3ubuntu3.3 | < 2.12.7+dfsg+really2.9.14-0.4ubuntu0.1
Wolfi1 product
- openjdk-7-jreAll versions (No fix recorded)
Xmlsoft1 product
- libxml2< 2.13.8 | ≥ 2.14.0, < 2.14.2
7 vendors · 28 products
