CVE-2025-6170

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-6170
A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.

2.5 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/errata/RHSA-2026:7519
https://access.redhat.com/security/cve/CVE-2025-6170 Mitigation Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2372952 Issue Tracking Third Party Advisory
https://gitlab.gnome.org/GNOME/libxml2/-/issues/941
https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:redhat:jboss_core_services:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:xmlsoft:libxml2:-:*:*:*:*:*:*:*
History

19 Apr 2026, 20:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:7519 -

24 Mar 2026, 05:16

Type Values Removed Values Added
References
  • () https://gitlab.gnome.org/GNOME/libxml2/-/issues/941 -

03 Nov 2025, 20:19

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html -
References () https://access.redhat.com/security/cve/CVE-2025-6170 - Third Party Advisory, Mitigation () https://access.redhat.com/security/cve/CVE-2025-6170 - Mitigation, Third Party Advisory

12 Aug 2025, 13:04

Type Values Removed Values Added
References () https://access.redhat.com/security/cve/CVE-2025-6170 - () https://access.redhat.com/security/cve/CVE-2025-6170 - Third Party Advisory, Mitigation
References () https://bugzilla.redhat.com/show_bug.cgi?id=2372952 - () https://bugzilla.redhat.com/show_bug.cgi?id=2372952 - Issue Tracking, Third Party Advisory
First Time Redhat
Redhat enterprise Linux
Redhat openshift Container Platform
Xmlsoft
Xmlsoft libxml2
Redhat jboss Core Services
CPE cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_core_services:-:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:a:xmlsoft:libxml2:-:*:*:*:*:*:*:*

17 Jun 2025, 20:50

Type Values Removed Values Added
Summary
  • (es) Se detectó una falla en el shell interactivo de la herramienta de línea de comandos xmllint, utilizada para analizar archivos XML. Cuando un usuario introduce un comando demasiado largo, el programa no verifica correctamente el tamaño de entrada, lo que puede provocar un bloqueo. Este problema podría permitir a los atacantes ejecutar código dañino en configuraciones poco comunes sin protecciones modernas.

16 Jun 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-16 16:15

Updated : 2026-04-19 20:16

NVD link : CVE-2025-6170

Mitre link : CVE-2025-6170

CVE.ORG link : CVE-2025-6170

JSON object : View

Products Affected

redhat

  • enterprise_linux
  • jboss_core_services
  • openshift_container_platform

xmlsoft

  • libxml2
CWE
CWE-121

Stack-based Buffer Overflow