{"id":"CVE-2025-12863","aliases":["BELL-CVE-2025-12863","DEBIAN-CVE-2025-12863","EUVD-2025-38299","GHSA-9fwq-22j4-xfwr","ROOT-OS-DEBIAN-11-CVE-2025-12863","UBUNTU-CVE-2025-12863"],"status":"rejected","title":"A flaw was found in the xmlSetTreeDoc() function of the libxml2 XML parsing library. This...","description":"This CVE was assigned for a libxml2 issue#1012 but later deemed not valid. Ref.: https://gitlab.gnome.org/GNOME/libxml2/-/issues/1012#note_2608283","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2025-11-07T20:59:35Z","modified":"2026-09-10T11:15:06Z","fixes":[{"ecosystem":"Root:Debian:11","package":"libxml2","fixed_in":["2.9.10+dfsg-6.7+deb11u10.aikido.9"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-libxml2","fixed_in":["2.9.10+dfsg-6.7+deb11u10.aikido.9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Root:Debian:11","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-6.7+deb11u10.aikido.9"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.10+dfsg-6.7+deb11u10.aikido.9"}]}]}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12863"},{"url":"https://access.redhat.com/security/cve/CVE-2025-12863","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2413323","tags":["report"]},{"url":"https://github.com/advisories/GHSA-9fwq-22j4-xfwr"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-12863","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-12863","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-12863","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-12863","tags":["report"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/349","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-12863","description":"This CVE was assigned for a libxml2 issue#1012 but later deemed not valid. Ref.: https://gitlab.gnome.org/GNOME/libxml2/-/issues/1012#note_2608283","status":"rejected","published":"2025-11-07T20:59:35.021Z","modified":"2025-11-20T12:11:37.79Z","updated_at":"2026-11-02T14:32:41.743125Z"}],"euvd":[{"id":"EUVD-2025-38299","description":"This CVE was assigned for a libxml2 issue#1012 but later deemed not valid. Ref.: https://gitlab.gnome.org/GNOME/libxml2/-/issues/1012#note_2608283","status":"published","published":"2025-11-07T20:59:35Z","modified":"2025-11-20T12:11:37Z","updated_at":"2026-11-02T19:49:15.042838Z"}],"ghsa":[{"id":"GHSA-9fwq-22j4-xfwr","title":"A flaw was found in the xmlSetTreeDoc() function of the libxml2 XML parsing library. This...","description":"A flaw was found in the xmlSetTreeDoc() function of the libxml2 XML parsing library. This function is responsible for updating document pointers when XML nodes are moved between documents. Due to improper handling of namespace references, a namespace pointer may remain linked to a freed memory region when the original document is destroyed. As a result, subsequent operations that access the namespace can lead to a use-after-free condition, causing an application crash.","status":"published","published":"2025-11-07T21:31:20Z","modified":"2025-11-07T21:31:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:04:42.481044Z"}],"nvd":[{"id":"CVE-2025-12863","description":"Rejected reason: This CVE was assigned for a libxml2 issue#1012 but later deemed not valid. Ref.: https://gitlab.gnome.org/GNOME/libxml2/-/issues/1012#note_2608283","status":"rejected","published":"2025-11-07T21:15:40.393Z","modified":"2025-11-20T15:17:23.673Z","updated_at":"2026-11-02T14:11:42.870953Z"}],"osv":[{"id":"BELL-CVE-2025-12863","title":"CVE-2025-12863 does not affect BellSoft software","status":"withdrawn","published":"2025-11-08T06:06:35.950275Z","modified":"2026-01-26T09:41:23.065768Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:21.227396Z"},{"id":"DEBIAN-CVE-2025-12863","description":"A flaw was found in the xmlSetTreeDoc() function of the libxml2 XML parsing library. This function is responsible for updating document pointers when XML nodes are moved between documents. Due to improper handling of namespace references, a namespace pointer may remain linked to a freed memory region when the original document is destroyed. As a result, subsequent operations that access the namespace can lead to a use-after-free condition, causing an application crash.","status":"withdrawn","published":"2025-11-07T21:15:40.393Z","modified":"2025-11-21T01:48:21.347798Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"UBUNTU-CVE-2025-12863","description":"A flaw was found in the xmlSetTreeDoc() function of the libxml2 XML parsing library. This function is responsible for updating document pointers when XML nodes are moved between documents. Due to improper handling of namespace references, a namespace pointer may remain linked to a freed memory region when the original document is destroyed. As a result, subsequent operations that access the namespace can lead to a use-after-free condition, causing an application crash.","status":"withdrawn","published":"2025-11-07T21:15:00Z","modified":"2025-11-27T08:15:04.302294Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2025-12863","title":"CVE-2025-12863 in libxml2 - Patched by Root","description":"Root has patched CVE-2025-12863 in the libxml2 package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-09-10T10:22:04Z","modified":"2026-09-10T11:15:06.336231745Z","updated_at":"2026-11-02T15:53:29.077857Z"}]}}