CVE-2025-32414

Name	CVE-2025-32414
Description	In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4146-1, DSA-5949-1
Debian Bugs	1102521

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libxml2 (PTS)	bullseye	2.9.10+dfsg-6.7+deb11u4	vulnerable
	bullseye (security)	2.9.10+dfsg-6.7+deb11u9	fixed
	bookworm, bookworm (security)	2.9.14+dfsg-1.3~deb12u4	fixed
	trixie (security), trixie	2.12.7+dfsg+really2.9.14-2.1+deb13u1	fixed
	forky	2.14.6+dfsg-0.1	fixed
	sid	2.15.1+dfsg-0.3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
libxml2	source	bullseye	2.9.10+dfsg-6.7+deb11u7	DLA-4146-1
libxml2	source	bookworm	2.9.14+dfsg-1.3~deb12u2	DSA-5949-1
libxml2	source	(unstable)	2.12.7+dfsg+really2.9.14-1		1102521

https://gitlab.gnome.org/GNOME/libxml2/-/issues/889