CVE-2025-27113: Xmlsoft Libxml2 Use After Free Flaw

CVE-2025-27113 Overview

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.

Critical Impact

This vulnerability could lead to a denial of service condition when exploited.

Affected Products

• xmlsoft libxml2

Discovery Timeline

• 2025-02-18 - CVE CVE-2025-27113 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-27113

Vulnerability Analysis

The vulnerability is due to improper handling of XML patterns, leading to a null pointer dereference. This occurs specifically in the xmlPatMatch function within the pattern.c file of the affected libxml2 versions. Exploitation can potentially disrupt service availability due to application crashes.

Root Cause

The root cause is a missing check for null pointers passed to the xmlPatMatch function, which is triggered during pattern matching operations.

Attack Vector

This vulnerability can be exploited remotely via network-based attacks that involve crafting malicious XML content.

// Example exploitation code (sanitized)
void exploit() {
    // Crafting malicious XML input
    xmlDocPtr doc = xmlParseDoc((const xmlChar*)"<data>");
    if (doc == NULL) {
        fprintf(stderr, "Document not parsed successfully\n");
        return;
    }
    // Intentional dereference
    xmlPatMatch(NULL);
    xmlFreeDoc(doc);
}

Detection Methods for CVE-2025-27113

Indicators of Compromise

• Unexpected application crashes
• Crash dumps referencing xmlPatMatch
• Log entries indicating XML parsing errors

Detection Strategies

Implement logging and monitoring of XML parsing operations, focusing on error messages and stack traces that may indicate a null pointer dereference.

Monitoring Recommendations

Regularly scan the application logs for patterns of unexpected termination or segmentation faults related to XML parsing operations. Utilize application performance management (APM) tools that can trace and alert on such anomalies.

How to Mitigate CVE-2025-27113

Immediate Actions Required

• Apply patches as soon as they become available
• Use input validation to check for malformed XML
• Monitor for application stability issues

Patch Information

Patches are available in libxml2 version 2.12.10 and 2.13.6. Users must update to these versions or later to mitigate the vulnerability.

Workarounds

If immediate patching is not possible, consider filtering input XML for known malicious patterns that could exploit this vulnerability.

# Configuration example
export XML_CATA_PLACEHOLDER=/etc/xml/catalog
xmlcatalog --noout --create $XML_CATA_PLACEHOLDER
xmlcatalog --noout --add "public" "-//OASIS//DTD XML Catalogs V1.0//EN" "http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd" $XML_CATA_PLACEHOLDER