Secuno
ENNL
Book demo

CVE-2025-6021

Xmlsoft Libxml2 buffer overflow

7.5 HIGHPublic exploitEPSS 1.37%
  1. Published12 Jun 2025

Description

A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityNone
IntegrityNone
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Redhat Jboss Core Servicesall versions
Redhat Openshift Container Platform4.12 · 4.13 · 4.14 · 4.15
Redhat Openshift Container Platform For Arm644.13 · 4.14 · 4.15 · 4.16
Redhat Openshift Container Platform For Ibm Z4.13 · 4.14 · 4.15 · 4.16
Redhat Openshift Container Platform For Linuxone4.13 · 4.14 · 4.15 · 4.16
Redhat Openshift Container Platform For Power4.13 · 4.14 · 4.15 · 4.16
Xmlsoft Libxml2< 2.14.4
Redhat Enterprise Linux10.0 · 8.0 · 9.0
Redhat Enterprise Linux Eus10.0 · 8.4 · 8.6 · 8.8
Redhat Enterprise Linux For Arm 6410.0_aarch64 · 8.0_aarch64 · 9.0_aarch64 · 9.4_aarch64
Redhat Enterprise Linux For Arm 64 Eus10.0_aarch64 · 9.4_aarch64 · 9.6_aarch64
Redhat Enterprise Linux For Ibm Z Systems10.0_s390x · 8.0_s390x · 9.4_s390x
Redhat Enterprise Linux For Ibm Z Systems Eus10.0_s390x · 9.0_s390x · 9.4_s390x · 9.6_s390x
Redhat Enterprise Linux For Power Little Endian10.0_ppc64le · 8.0_ppc64le · 9.0_ppc64le
Redhat Enterprise Linux For Power Little Endian Eus10.0_ppc64le · 9.4_ppc64le · 9.6_ppc64le
Redhat Enterprise Linux Server7.0
Redhat Enterprise Linux Server Aus8.2 · 8.4 · 8.6 · 9.2
Redhat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions9.4_ppc64le
Redhat Enterprise Linux Server Tus8.8
Redhat In-vehicle Operating System1.0

Remediation

Fixed in
Xmlsoft Libxml2≥ 2.14.4

References

and 18 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-1078158.5
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until…
CVE-2026-195708.8
The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies…
CVE-2026-1079099.1
A heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws.c) and the…
CVE-2026-1079089.8
A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c)…
CVE-2026-823448.1
IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow…
CVE-2026-823358.1
IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer…

Frequently asked

Is CVE-2025-6021 being actively exploited?

CVE-2025-6021 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 1.37%.

How severe is CVE-2025-6021?

CVE-2025-6021 has a CVSS 3.1 base score of 7.5, rated high. EPSS estimates a 1.37% probability of exploitation.

Which products are affected by CVE-2025-6021?

Affected products include Redhat Jboss Core Services, Redhat Openshift Container Platform, Redhat Openshift Container Platform For Arm64, Redhat Openshift Container Platform For Ibm Z, Redhat Openshift Container Platform For Linuxone, and 15 more.

How do I fix CVE-2025-6021?

Upgrade affected software to a fixed version, for example Xmlsoft Libxml2 2.14.4 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-6021 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.