CVE-2025-12863
A flaw was found in the xmlSetTreeDoc() function of the libxml2 XML parsing library. This...
This CVE was assigned for a libxml2 issue#1012 but later deemed not valid. Ref.: https://gitlab.gnome.org/GNOME/libxml2/-/issues/1012#note_2608283
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
What each source reports
GitHub Advisories Score usedGHSA-9fwq-22j4-xfwr
A flaw was found in the xmlSetTreeDoc() function of the libxml2 XML parsing library. This...
A flaw was found in the xmlSetTreeDoc() function of the libxml2 XML parsing library. This function is responsible for updating document pointers when XML nodes are moved between documents. Due to improper handling of namespace references, a namespace pointer may remain linked to a freed memory region when the original document is destroyed. As a result, subsequent operations that access the namespace can lead to a use-after-free condition, causing an application crash.
- Record
GHSA-9fwq-22j4-xfwr- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
This CVE was assigned for a libxml2 issue#1012 but later deemed not valid. Ref.: https://gitlab.gnome.org/GNOME/libxml2/-/issues/1012#note_2608283
- Record
CVE-2025-12863- Updated
- 2026-11-02
EUVDEUVD-2025-38299 No score
This CVE was assigned for a libxml2 issue#1012 but later deemed not valid. Ref.: https://gitlab.gnome.org/GNOME/libxml2/-/issues/1012#note_2608283
- Record
EUVD-2025-38299- Updated
- 2026-11-02
NVD No score
Rejected reason: This CVE was assigned for a libxml2 issue#1012 but later deemed not valid. Ref.: https://gitlab.gnome.org/GNOME/libxml2/-/issues/1012#note_2608283
- Record
CVE-2025-12863- Updated
- 2026-11-02
OSVBELL-CVE-2025-12863
CVE-2025-12863 does not affect BellSoft software
- Record
BELL-CVE-2025-12863- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-12863
A flaw was found in the xmlSetTreeDoc() function of the libxml2 XML parsing library. This function is responsible for updating document pointers when XML nodes are moved between documents. Due to improper handling of namespace references, a namespace pointer may remain linked to a freed memory region when the original document is destroyed. As a result, subsequent operations that access the namespace can lead to a use-after-free condition, causing an application crash.
- Record
DEBIAN-CVE-2025-12863- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-12863
A flaw was found in the xmlSetTreeDoc() function of the libxml2 XML parsing library. This function is responsible for updating document pointers when XML nodes are moved between documents. Due to improper handling of namespace references, a namespace pointer may remain linked to a freed memory region when the original document is destroyed. As a result, subsequent operations that access the namespace can lead to a use-after-free condition, causing an application crash.
- Record
UBUNTU-CVE-2025-12863- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2025-12863 No score
CVE-2025-12863 in libxml2 - Patched by Root
Root has patched CVE-2025-12863 in the libxml2 package for Root:Debian:11. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-11-CVE-2025-12863- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2025-12863 No score
CVE-2025-12863 in libxml2 - Patched by Root
Root has patched CVE-2025-12863 in the libxml2 package for Root:Debian:13. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-13-CVE-2025-12863- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libxml2Root:Debian:11 |
before 2.9.10+dfsg-6.7+deb11u10.aikido.9 | 2.9.10+dfsg-6.7+deb11u10.aikido.9 |
rootio-libxml2Root:Debian:11 |
before 2.9.10+dfsg-6.7+deb11u10.aikido.9 | 2.9.10+dfsg-6.7+deb11u10.aikido.9 |
libxml2Root:Debian:13 |
before 2.12.7+dfsg+really2.9.14-2.1+deb13u3.aikido.14 | 2.12.7+dfsg+really2.9.14-2.1+deb13u3.aikido.142.12.7+dfsg+really2.9.14-2.1+deb13u3.aikido.132.12.7+dfsg+really2.9.14-2.1+deb13u3.root.io.122.12.7+dfsg+really2.9.14-2.1+deb13u3.aikido.152.12.7+dfsg+really2.9.14-2.1+deb13u3.aikido.16 |
rootio-libxml2Root:Debian:13 |
before 2.12.7+dfsg+really2.9.14-2.1+deb13u3.aikido.14 | 2.12.7+dfsg+really2.9.14-2.1+deb13u3.aikido.142.12.7+dfsg+really2.9.14-2.1+deb13u3.aikido.132.12.7+dfsg+really2.9.14-2.1+deb13u3.root.io.122.12.7+dfsg+really2.9.14-2.1+deb13u3.aikido.152.12.7+dfsg+really2.9.14-2.1+deb13u3.aikido.16 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-12863 has been rejected by its source and should not be treated as a live vulnerability, published November 7, 2025. Fixed in libxml2 2.9.10+dfsg-6.7+deb11u10.aikido.9.
References
nvd.nist.gov/vuln/detail/CVE-2025-12863
access.redhat.com/security/cve/CVE-2025-12863
bugzilla.redhat.com/show_bug.cgi?id=2413323
github.com/advisories/GHSA-9fwq-22j4-xfwr
docs.bell-sw.com/security/cves/CVE-2025-12863
security-tracker.debian.org/tracker/CVE-2025-12863
ubuntu.com/security/CVE-2025-12863
cve.org/CVERecord?id=CVE-2025-12863
gitlab.gnome.org/GNOME/libxml2/-/merge_requests/349