CVE-2025-26434: 
NixOS vulnerability analysis and mitigation

CVE-2025-26434 is a vulnerability discovered in libxml2, disclosed on September 5, 2025. The vulnerability affects the upstream libxml2 package version 2.14.0, where a possible out of bounds read due to a buffer overflow exists. This security flaw was introduced in libxml2 version 2.14.0 and subsequently fixed in the same version (Debian Tracker).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium), with an Impact Score of 3.6 and Exploitability Score of 1.8. The CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating a local attack vector, low attack complexity, low privileges required, no user interaction needed, unchanged scope, high confidentiality impact, and no impact on integrity or availability. The vulnerability is classified as CWE-120 (AttackerKB).

The vulnerability can lead to local information disclosure without requiring additional execution privileges. The EPSS (Exploit Prediction Scoring System) probability is reported at 0.01% (1st percentile), suggesting a relatively low likelihood of exploitation in the wild (Snyk).

The vulnerability has been fixed in libxml2 through commit 5e7874015ef5ed8b2705eb2f7b0960f56f7760ea. Various Linux distributions have released patches, including Debian which has fixed versions available for multiple releases: bullseye (2.9.10+dfsg-6.7+deb11u8), bookworm (2.9.14+dfsg-1.3~deb12u4), and trixie (2.12.7+dfsg+really2.9.14-2.1+deb13u1) (Debian Tracker).