Junglewise Threat Intelligence

CVE-2025-6170: GNOME libxml2 stack buffer overflow in xmllint interactive shell

CVE-2025-6170 · Severity: low · CVSS 2.5 · Published 2025-06-16

Technologies: Red Hat Enterprise Linux, Siemens SINEC OS. Vendors: Gnome, Red Hat, Siemens.

Executive brief

A security flaw exists in the interactive shell of xmllint, a tool used for processing XML files. If a user is tricked into entering an extremely long command into this shell, the application may crash or, in very specific and rare circumstances, allow for unauthorized code execution. This issue primarily affects developers or administrators manually using the xmllint interactive mode and is unlikely to impact automated server operations.

Technical details

A stack-based buffer overflow (CWE-121) exists in the xmllintShell function within shell.c of libxml2. The vulnerability is caused by a lack of bounds checking in a while loop that copies user-supplied command arguments into a fixed-size 400-byte stack buffer ('arg'). An attacker who can provide input to the interactive shell can trigger an out-of-bounds write by supplying an argument exceeding 400 bytes. While this reliably causes a crash (Denial of Service), arbitrary code execution is only theoretically possible on systems lacking modern exploit mitigations like stack canaries or NX-bits. The attack requires local access and user interaction to input the malicious string into the xmllint shell.

Affected products

  • GNOME libxml2 versions before 2.15.2-0.3.hum1 (Red Hat), 2.9.10+dfsg-6.7+deb11u8 (Debian)
  • Red Hat Enterprise Linux 6.0, 7.0, 8.0, 9.0, 10.0
  • Siemens SINEC OS before V4.0

Timeline

  • 2025-06-16: disclosed: Initial report and CVE assignment
  • 2025-07-26: patched: Debian released fixed libxml2 packages
  • 2026-04-10: patched: Red Hat released security advisory RHSA-2026:7519
  • 2026-06-02: advisory: Siemens published advisory SSA-253495

References

Related threats