Introduction
Application crashes and memory corruption in critical infrastructure often trace back to small flaws in foundational libraries. CVE-2025-12863 is one of those flaws. It affects libxml2, a core XML parsing library used across Linux distributions and enterprise products. Exploitation can occur when XML nodes are moved between documents, and it can lead to a use-after-free and service disruption.
The GNOME project maintains libxml2, and it is widely embedded in operating systems, application servers, and middleware. Environments from cloud platforms to embedded devices depend on it for XML processing.
Technical Information
CVE-2025-12863 comes from the way the xmlSetTreeDoc function in libxml2 handles namespace pointers. When an XML node is moved from one document to another, xmlSetTreeDoc updates the node's document pointer but does not always update its namespace pointer (node->ns). If the source document is then destroyed, the namespace pointer may reference freed memory. Any later operation that reads the namespace can trigger a use-after-free, and the result is an application crash or memory corruption.
The bug is most likely to appear during cross-document node moves, especially when code calls functions such as xmlAddChild or xmlReplaceNode without reconciling namespaces first. The vulnerability is classified as CWE-416 (Use After Free). The libxml2 issue tracker documents the technical analysis and the affected code paths (see libxml2 issue 1012).
Affected Systems and Versions
- libxml2 versions prior to 2.14.5 are affected (Flatcar issue 1813).
- IBM AIX: AIX 7.2.5 (APAR IJ55266 with SP11), AIX 7.3.1 (APAR IJ55267), AIX 7.3.2 (APAR IJ55268), AIX 7.3.3 (APAR IJ55269 with SP02)
- IBM VIOS: VIOS 3.1.4 (APAR IJ55266), VIOS 4.1.0 (APAR IJ55268), VIOS 4.1.1 (APAR IJ55269 with FP 4.1.1.20)
- Red Hat Enterprise Linux: RHEL 8.2 Advanced Update Support (RHSA-2025:12237), RHEL 9.4 Extended Update Support (RHSA-2025:13677), RHEL 8.4 Advanced Mission Critical Update Support (RHSA-2025:13788)
- SUSE Linux Enterprise Server: SLES 12 SP5 LTSS (SUSE-SU-2025:02547-1)
- Ubuntu: 25.04 (plucky), 24.04 LTS (noble), 22.04 LTS (jammy) (USN-7852-1)
Any application statically or dynamically linked against an affected libxml2 version is potentially vulnerable. That includes Python, PHP, and other language bindings.
Vendor Security History
libxml2 has a history of memory-safety issues, including:
- CVE-2025-6021: Stack-based buffer overflow in xmlBuildQName
- CVE-2025-49794: Use after free in XPath element parsing
- CVE-2025-49796: Memory corruption in sch:name element processing
The response to CVE-2025-12863 has been prompt, with coordinated advisories and patches from IBM, Red Hat, SUSE, Ubuntu, and others. Still, similar vulnerabilities keep recurring, which points to ongoing problems with memory management in libxml2.
