CVE-2025-32414

Description

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.

Affected products

Vendor	Product	Affected	Fixed
xmlsoft	libxml2	< 2.13.8, 2.14.0 – < 2.14.2	2.13.8

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	libxml2	2.12.7+dfsg+really2.9.14-1	—
Debian 13	libxml2	2.12.7+dfsg+really2.9.14-1	—
Debian 12	libxml2	2.9.14+dfsg-1.3~deb12u2	DSA-5949-1
Debian 11	libxml2	2.9.10+dfsg-6.7+deb11u7	DLA-4146-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 25.10	libxml2	2.12.7+dfsg+really2.9.14-0.4ubuntu0.1	—
Ubuntu 24.04 LTS	libxml2	2.9.14+dfsg-1.3ubuntu3.3	USN-7467-1
Ubuntu 22.04 LTS	libxml2	2.9.13+dfsg-1ubuntu0.7	USN-7467-1
Ubuntu 20.04 LTS	libxml2	2.9.10+dfsg-5ubuntu0.20.04.10	USN-7467-1

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 18.04 LTS	libxml2	2.9.4+dfsg1-6.1ubuntu1.9+esm3	USN-7467-2
Ubuntu Pro 16.04 LTS	libxml2	2.9.3+dfsg1-1ubuntu0.7+esm8	USN-7467-2
Ubuntu Pro 14.04 LTS	libxml2	2.9.1+dfsg1-3ubuntu4.13+esm10	USN-7896-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 10	libxml2 +3	2.12.5-9.el10_0	RHSA-2025:13429
RHEL 9	libxml2 +2	2.9.13-12.el9_6	RHSA-2025:13428
RHEL 8	libxml2 +2	2.9.7-20.el8_10	RHSA-2025:8958

Show 13 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 9.4 EUS	libxml2 +2	2.9.13-12.el9_4	RHSA-2025:13677
RHEL 9.2 E4S	libxml2 +2	2.9.13-3.el9_2.9	RHSA-2025:13683
RHEL 9.0 E4S	libxml2 +2	2.9.13-1.el9_0.7	RHSA-2025:13684
RHEL 8.8 TUS	libxml2 +2	2.9.7-16.el8_8.9	RHSA-2025:12239
RHEL 8.8 E4S	libxml2 +2	2.9.7-16.el8_8.9	RHSA-2025:12239
RHEL 8.6 TUS	libxml2 +2	2.9.7-13.el8_6.10	RHSA-2025:12098
RHEL 8.6 E4S	libxml2 +2	2.9.7-13.el8_6.10	RHSA-2025:12098
RHEL 8.6 AUS	libxml2 +2	2.9.7-13.el8_6.10	RHSA-2025:12098
RHEL 8.4 EUS Long Life	libxml2 +2	2.9.7-9.el8_4.6	RHSA-2025:12241
RHEL 8.4 AUS	libxml2 +2	2.9.7-9.el8_4.6	RHSA-2025:12241
RHEL 8.2 AUS	libxml2 +2	2.9.7-9.el8_2.3	RHSA-2025:12237
RHEL 7 ELS	libxml2 +3	2.9.1-6.el7_9.10	RHSA-2025:12240
Red Hat Hardened Images 1	libxml2 +4	2.15.2-0.3.hum1	RHSA-2026:7519

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 10	libxml2 +3	2.12.5-9.el10_0	ALSA-2025:13429
AlmaLinux 9	libxml2 +2	2.9.13-12.el9_6	ALSA-2025:13428
AlmaLinux 8	libxml2 +2	2.9.7-20.el8_10	ALSA-2025:8958

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 10	libxml2	2.12.5-9.el10_0	RLSA-2025:13429
Rocky Linux 9	libxml2	2.9.13-12.el9_6	RLSA-2025:13428
Rocky Linux 8	libxml2	2.9.7-20.el8_10	RLSA-2025:8958

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP6	libxml2 +1	2.10.3-150500.5.26.1	SUSE-SU-2025:1438-1
SLES 12 SP5	libxml2 +1	2.9.4-46.84.1	SUSE-SU-2025:1440-1
SLES 3	libxml2-python	2.10.3-150500.5.26.1	SUSE-SU-2025:1438-1

Show 7 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLE Micro 6.1	libxml2	2.11.6-slfo.1.1_3.1	SUSE-SU-2025:20364-1
SLE Micro 6.0	libxml2	2.11.6-8.1	SUSE-SU-2025:20333-1
SLE Micro 5.5	libxml2 +1	2.10.3-150500.5.26.1	SUSE-SU-2025:1438-1
SLE Micro 5.4	libxml2 +1	2.9.14-150400.5.41.1	SUSE-SU-2025:1435-1
SLE Micro 5.3	libxml2 +1	2.9.14-150400.5.41.1	SUSE-SU-2025:1435-1
SLE Micro 5.2	libxml2 +1	2.9.7-150000.3.79.1	SUSE-SU-2025:1439-1
SLE Micro 5.1	libxml2	2.9.7-150000.3.79.1	SUSE-SU-2025:1439-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	libxml2	2.13.8-1.1	openSUSE-SU-2025:15019-1
openSUSE Leap 15.6	libxml2 +1	2.10.3-150500.5.26.1	SUSE-SU-2025:1438-1
openSUSE Leap 15.6	python-libxml2-python	2.9.7-150000.3.79.1	SUSE-SU-2025:1439-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	libxml2	2.13.8-r0	—
Alpine v3.23	libxml2	2.13.8-r0	—
Alpine v3.22	libxml2	2.13.8-r0	—
Alpine v3.21	libxml2	2.13.4-r6	—
Alpine v3.20	libxml2	2.12.10-r0	—

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Alpine v3.19	libxml2	2.11.8-r3	—
Alpine v3.18	libxml2	2.11.8-r3	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	libxml2 +3	2.10.4-1.amzn2023.0.10	ALAS2023-2025-963
Amazon Linux 2	libxml2 +3	2.9.1-6.amzn2.5.17	ALAS2-2025-2860

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	libxml2	2.11.5-5	—
Azure Linux 2 (CBL-Mariner)	libxml2	2.10.4-7	—

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 10	libxml2 +3	2.12.5-9.el10_0	ELSA-2025-13429
Oracle Linux 9	libxml2 +2	2.9.13-12.el9_6	ELSA-2025-13428
Oracle Linux 8	libxml2 +2	2.9.7-20.el8_10	ELSA-2025-8958
Oracle Linux 7	libxml2 +3	2.9.1-6.0.7.el7_9.6	ELSA-2025-12240

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	openjdk-7-jre	No fix yet	—

Advisories 38

ALSA-2025:13429 Moderate: libxml2 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2025:13428 Moderate: libxml2 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2025:8958 Moderate: libxml2 security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2026:7519 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 15, 2026
RHSA-2025:12241 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
RHSA-2025:12239 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
RHSA-2025:12240 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
RHSA-2025:12237 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
RHSA-2025:12098 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
RHSA-2025:8958 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:13684 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:13677 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:13683 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:13429 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:13428 Red Hat Security Advisory: libxml2 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
WID-SEC-2025-1439 Dell Secure Connect Gateway: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Oct 11, 2026
WID-SEC-2025-0730 libxml2: Schwachstelle ermöglicht Manipulation von Dateien BSI CERT-Bund (WID) · Jun 29, 2026
USN-7467-2 libxml2 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
USN-7896-1 libxml2 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
USN-7467-1 libxml2 vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
SUSE-SU-2025:20333-1 Security update for libxml2 SUSE / openSUSE Security Updates · Mar 23, 2026
SUSE-SU-2025:1435-1 Security update for libxml2 SUSE / openSUSE Security Updates · Mar 23, 2026
SUSE-SU-2025:20364-1 Security update for libxml2 SUSE / openSUSE Security Updates · Mar 23, 2026
DSA-5949-1 libxml2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-4146-1 libxml2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
SUSE-SU-2025:1438-1 Security update for libxml2 SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2025:1440-1 Security update for libxml2 SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2025:15019-1 libxml2-2-2.13.8-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2025:1439-1 Security update for libxml2 SUSE / openSUSE Security Updates · Feb 4, 2026
RLSA-2025:13429 Moderate: libxml2 security update Rocky Linux Security Advisories · Oct 8, 2025
RLSA-2025:13428 Moderate: libxml2 security update Rocky Linux Security Advisories · Oct 7, 2025
ELSA-2025-12240 Important: libxml2 security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 13, 2025
ELSA-2025-13429 Moderate: libxml2 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 8, 2025
ELSA-2025-13428 Moderate: libxml2 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 7, 2025
RLSA-2025:8958 Moderate: libxml2 security update Rocky Linux Security Advisories · Jul 29, 2025
ELSA-2025-8958 Moderate: libxml2 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jun 11, 2025
ALAS2-2025-2860 Moderate: libxml2 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 29, 2025
ALAS2023-2025-963 Moderate: libxml2 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 13, 2025

References

https://gitlab.gnome.org/GNOME/libxml2/-/issues/889

CNA	v3.1	5.6
EUVD	v3.1	5.6

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an …

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

AlmaLinux

Rocky Linux

SUSE

openSUSE

Alpine

Amazon Linux

Azure Linux

Oracle Linux

Wolfi

Advisories 38

References