Critical NULL Pointer Dereference in libxml2 - CVE-2025-27113
Summary
CVE-2025-27113: libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c. Affects libxml2 across 3 version ranges.
< 2.11.8-r2
< 02d577715e1951cf114ca4e9adaf5605156c4f4c
>= cdd2575f7fbab1d8162600f4048bc37503c80e28, < 66453240c94b5cbd3e9ae9b32016fdafb13cdf18
Fixed in 2.11.8-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxml2 is a widely-used XML parsing library that provides a range of functionalities for processing XML documents. It is known for its performance and compliance with standards, making it a popular choice in various applications. However, vulnerabilities in this library can lead to severe issues, including application crashes and potential exploitation by attackers.
Vulnerability Detail
CVE-2025-27113 is a critical vulnerability found in libxml2 versions prior to 2.12.10 and 2.13.x before 2.13.6. The vulnerability arises from a NULL pointer dereference in the xmlPatMatch function located in pattern.c. This flaw can lead to application crashes, potentially allowing attackers to exploit the situation to execute arbitrary code or cause denial of service attacks. The vulnerability is particularly concerning as it affects multiple Debian ecosystems, making it a widespread issue.
How To Fix
Minimum fixed version
2.11.8-r2
This is the first release that contains the fix.
sudo apk add --upgrade libxml2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the specific functionalities that trigger the NULL pointer dereference until the package is updated. However, this is not a permanent solution and should only be considered until an update is applied.
Conclusion
CVE-2025-27113 is a significant vulnerability in libxml2 that poses risks to applications relying on this library. It is crucial for users to update to the latest versions to protect against potential exploitation. Regular monitoring and updates are essential to maintain security.
See every vulnerability recorded for libxml2 →
FAQ
CVE-2025-27113 is a vulnerability in libxml2 that causes a NULL pointer dereference, potentially leading to application crashes.
libxml2 versions before 2.12.10 and 2.13.x before 2.13.6 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without requiring any installation.
The risks include application crashes and potential exploitation by attackers, which could lead to arbitrary code execution or denial of service.
You can update libxml2 using the command 'sudo apt-get update && sudo apt-get install libxml2' to ensure you have the latest patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxml2.
