{"id":"CVE-2025-71346","aliases":["GHSA-5w6v-399v-w3cc"],"url":"https://o3.security/vulnerability/CVE-2025-71346","summary":"Nokogiri before 1.18.8 Heap Buffer Under-read via XML Schema","details":"## Summary\n\nNokogiri v1.18.8 upgrades its dependency libxml2 to [v2.13.8](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.8).\n\nlibxml2 v2.13.8 addresses:\n\n- CVE-2025-32414\n  - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/889\n- CVE-2025-32415\n  - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/890\n\n## Impact\n\n### CVE-2025-32414: No impact\n\nIn libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.\n\n**There is no impact** from this CVE for Nokogiri users.\n\n\n### CVE-2025-32415: Low impact\n\nIn libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.\n\nIn the upstream issue, further context is provided by the maintainer:\n\n> The bug affects validation against untrusted XML Schemas (.xsd) and validation of untrusted\n> documents against trusted Schemas if they make use of xsd:keyref in combination with recursively\n> defined types that have additional identity constraints.\n\nMITRE has published a severity score of 2.9 LOW (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) for this CVE.","published":"2026-08-25T15:15:57.921Z","modified":"2026-08-30T03:31:01.435145691Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"RubyGems","name":"nokogiri","fixedVersion":"1.18.8"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71346.json"},{"type":"ADVISORY","url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5w6v-399v-w3cc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71346"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/nokogiri-before-heap-buffer-under-read-via-xml-schema"},{"type":"PACKAGE","url":"https://github.com/sparklemotion/nokogiri"},{"type":"WEB","url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/889"},{"type":"WEB","url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/890"},{"type":"WEB","url":"https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.8"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-30T03:31:01.435145691Z"}}