CVE-2025-27113

CWE-476 — NULL Pointer Dereference17 documents10 sources
Severity
7.5HIGH
EPSS
0.1%
top 73.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Xmlsoft Libxml2
Timeline
PublishedFeb 18
Latest updateJul 15

Description

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 1.4 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5xmlsoft/libxml22.13.0 — 2.13.6+1
▶NVDxmlsoft/libxml22.13.0 — 2.13.6+1
▶Debianlibxml2< 2.9.10+dfsg-6.7+deb11u6+3

🔴Vulnerability Details

3
GHSA
GHSA-m9m6-wcr9-hh75: libxml2 before 2↗2025-02-19
▶
CVEList
CVE-2025-27113: libxml2 before 2↗2025-02-18
▶
OSV
CVE-2025-27113: libxml2 before 2↗2025-02-18
▶

📋Vendor Advisories

13
Oracle
Oracle Oracle Communications Risk Matrix: ATS Framework (libxml2) — CVE-2025-27113↗2025-07-15
▶
Apple
CVE-2025-27113: watchOS 11.4↗2025-04-01
▶
Apple
CVE-2025-27113: visionOS 2.4↗2025-03-31
▶
Apple
CVE-2025-27113: iOS 18.4 and iPadOS 18.4↗2025-03-31
▶
Apple
CVE-2025-27113: macOS Sequoia 15.4↗2025-03-31
▶
CVE-2025-27113 (HIGH CVSS 7.5) | libxml2 before 2.12.10 and 2.13.x b | cvebase.io