CVE-2025-71346

[CVE catalog]

Severity

High · CVSS 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Jan 1, 2025, 12:00:00 AM UTC

Updated

Aug 25, 2026, 5:17:04 PM UTC

Source

[NVD] · [CVE record]

A flaw was found in Nokogiri, which packages a vulnerable version of libxml2. This heap-based buffer under-read vulnerability, located in the xmlSchemaIDCFillNodeTables function, can be triggered when processing untrusted XML Schemas or documents. A remote attacker could exploit this by providing specially crafted XML input, which may lead to unexpected application behavior or a limited denial of service (DoS). nokogiri: libxml2: Nokogiri: Heap buffer under-read in XML Schema validation This flaw has a Low impact as it requires applications utilizing Nokogiri to process specially crafted, untrusted XML schemas or documents that include specific identity constraints. Exploitation is limited to scenarios where vulnerable applications perform XML validation on untrusted input, potentially leading to a denial of service. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.