Critical NULL Pointer Dereference Vulnerability in libxml2
Summary
DEBIAN-CVE-2025-27113: libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c. Affects libxml2 versions < 2.9.10+dfsg-6.7+deb11u6. Fixed in 2.9.10+dfsg-6.7+deb11u6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxml2 is a widely used XML parsing library that provides a range of functionalities for processing XML and HTML documents. It is known for its efficiency and flexibility, making it a popular choice among developers for applications that require XML manipulation. However, recent findings have revealed a critical vulnerability that affects multiple versions of this library, potentially compromising applications that rely on it.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2025-27113 is a NULL pointer dereference occurring in the xmlPatMatch function within pattern.c of libxml2 versions prior to 2.12.10 and 2.13.x before 2.13.6. This flaw can lead to application crashes or unexpected behavior, which may be exploited by attackers to disrupt services or execute arbitrary code. The issue arises from improper handling of certain XML patterns, allowing for a denial of service attack or other malicious exploitation.
How To Fix
Minimum fixed version
2.9.10+dfsg-6.7+deb11u6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxml2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to ensure that XML patterns processed by your application do not lead to NULL pointer dereferences. This can involve sanitizing inputs and avoiding the use of untrusted XML data.
Conclusion
The NULL pointer dereference vulnerability in libxml2 poses significant risks to applications relying on this library. It is crucial to update to the patched versions to ensure the security and stability of your applications. Regular monitoring for vulnerabilities using tools like Vulert can help maintain a secure software environment.
See every vulnerability recorded for libxml2 →
FAQ
The vulnerability is a NULL pointer dereference that can cause application crashes or unexpected behavior.
Versions of libxml2 prior to 2.12.10 and 2.13.x before 2.13.6 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Update the libxml2 package to the latest patched version as specified in the 'how to fix' section.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for libxml2.
