CVE-2025-32414: libxml2 — Exploit & Fix

Description

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.

Is your site exposed to CVE-2025-32414?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.6

MEDIUM

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

Weakness Type (CWE)

CWE-393 CWE-393

CWE-252 CWE-252

Affected Products

Vendor	Product	Versions
xmlsoft	libxml2	< 2.13.8
xmlsoft	libxml2	2.14.0 — 2.14.2

References

Frequently Asked Questions

What is CVE-2025-32414? +

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters. It has a CVSS v3.1 base score of 5.6 (MEDIUM).

How severe is CVE-2025-32414? +

CVE-2025-32414 has a CVSS v3.1 score of 5.6 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-32414? +

CVE-2025-32414 affects products from xmlsoft, specifically: libxml2. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-32414? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-85087

Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before …

CVE-2026-85483

Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: …

CVE-2026-9058

Szafir SDK returns a success status code from the cryptographic digital signature verification process (i.e. /VerifyingTaskItem/Signature/VerificationResult/Result/@code == 0, "Positively verified") …

CVE-2026-42246

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a …

CVE-2026-92834

Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache …

CVE-2026-97381 9.9

Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains …