Critical NULL Pointer Dereference in libxml2: CVE-2025-27113
Summary
ALPINE-CVE-2025-27113: libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c. Affects libxml2 versions < 2.11.8-r2. Fixed in 2.11.8-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxml2 is a widely used XML parsing library that provides tools for processing XML and HTML documents. It is known for its performance and compliance with standards, making it a popular choice for developers. However, certain versions of libxml2 are vulnerable to a NULL pointer dereference, which can lead to application crashes and potential denial of service.
Vulnerability Detail
The vulnerability identified as CVE-2025-27113 affects libxml2 versions prior to 2.12.10 and 2.13.x before 2.13.6. It originates from a NULL pointer dereference in the xmlPatMatch function located in pattern.c. This flaw can be exploited by attackers to cause crashes in applications that rely on libxml2 for XML processing, leading to service interruptions and degraded application performance.
How To Fix
Minimum fixed version
2.11.8-r2
This is the first release that contains the fix.
sudo apk add --upgrade libxml2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to prevent malformed XML from being processed, which may mitigate the risk of exploitation until the package can be updated.
Conclusion
CVE-2025-27113 is a critical vulnerability in libxml2 that can lead to significant application disruptions. It is crucial for users to update to the latest patched versions to mitigate risks associated with this vulnerability. Regular monitoring and updates are essential for maintaining application security.
See every vulnerability recorded for libxml2 →
FAQ
CVE-2025-27113 is a vulnerability in libxml2 that allows for a NULL pointer dereference, potentially leading to application crashes.
Affected versions include libxml2 before 2.12.10 and 2.13.x before 2.13.6.
Exploitation of this vulnerability can lead to application crashes and denial of service, affecting the availability of services relying on libxml2.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2025-27113 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxml2.
