CVE-2025-6021

Published Jun 12, 2025

Last updated a month ago

CVSS high 7.5

Overview

Description
A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.
Source
secalert@redhat.com
NVD status
Modified
Products
libxml2, jboss_core_services, openshift_container_platform, openshift_container_platform_for_arm64, openshift_container_platform_for_ibm_z, openshift_container_platform_for_linuxone, openshift_container_platform_for_power, enterprise_linux, enterprise_linux_eus, enterprise_linux_for_arm_64, enterprise_linux_for_arm_64_eus, enterprise_linux_for_ibm_z_systems, enterprise_linux_for_ibm_z_systems_eus, enterprise_linux_for_power_little_endian, enterprise_linux_for_power_little_endian_eus, enterprise_linux_server, enterprise_linux_server_aus, enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions, enterprise_linux_server_tus, in-vehicle_operating_system

Risk scores

CVSS 3.1

Type
Secondary
Base score
7.5
Impact score
3.6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity
HIGH

Weaknesses

secalert@redhat.com
CWE-190
nvd@nist.gov
CWE-787

Social media

Hype score
Not currently trending

  1. 🚨 Critical #libxml2 patch for #openSUSE (CVE-2025-49794 to CVE-2025-6021). DoS/RCE risks! Update via: zypper patch Details: 👉 https://t.co/ispqm7BtNi https://t.co/3R8b5vB5Ak

    @Cezar_H_Linux

    16 Jul 2025

    28 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. CVE-2025-6021 (CVSS:7.5, HIGH) is Awaiting Analysis. A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a ..https://t.co/Owiw4Olwmy #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre

    @cracbot

    17 Jun 2025

    9 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. 5 CVEs in libxml2 https://t.co/nHoIvYT13R CVE-2025-49794: Heap UAF DoS CVE-2025-49795: Null pointer dereference DoS CVE-2025-49796: Type confusion DoS CVE-2025-6021: Integer and Buffer Overflow in xmlBuildQName() CVE-2025-6170: Stack-based Buffer Overflow in xmllint Shell

    @oss_security

    17 Jun 2025

    2650 Impressions

    11 Retweets

    24 Likes

    8 Bookmarks

    1 Reply

    1 Quote

  4. CVE-2025-6021 A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can resu… https://t.co/7op4f9yvQH

    @CVEnew

    12 Jun 2025

    295 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations

Related CVEs

  1. A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption headers without authorization. The issue occurs because a privileged D-Bus method responsible for exporting encryption metadata does not perform a policy check. As a result, sensitive cryptographic metadata can be read and written to attacker-controlled locations. This weakens the confidentiality guarantees of encrypted storage volumes.•CVE-2026-26104
  2. A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization checks. The issue allows a local unprivileged user to instruct the root-owned udisks daemon to overwrite encryption metadata on block devices. This can permanently invalidate encryption keys and render encrypted volumes inaccessible. Successful exploitation results in a denial-of-service condition through irreversible data loss.•CVE-2026-26103
  3. A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.•CVE-2025-14512
  4. A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings.•CVE-2025-14087
  5. A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.•CVE-2025-13601

References

Sources include official advisories and independent security research.