CVE-2025-71436

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-71436", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-20T14:50:46.229Z", "datePublished": "2026-10-20T15:40:22.461Z", "dateUpdated": "2026-10-20T16:41:49.461Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-20T15:40:22.461Z"}, "datePublic": "2025-10-18T08:56:39.000Z", "title": "Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Tag", "descriptions": [{"lang": "en", "value": "Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Heap-based Buffer Overflow", "cweId": "CWE-122", "type": "CWE"}]}], "affected": [{"vendor": "librdf", "product": "Raptor RDF Syntax Library", "packageURL": "pkg:github/dajobe/raptor", "defaultStatus": "unaffected", "versions": [{"version": "2.0.15", "lessThanOrEqual": "2.0.16", "status": "affected", "versionType": "semver"}], "repo": "https://github.com/dajobe/raptor"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:librdf:raptor_rdf_syntax_library:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.0.15", "versionEndIncluding": "2.0.16"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/dajobe/raptor/issues/83", "tags": ["issue-tracking"]}, {"url": "https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575", "tags": ["patch"]}, {"url": "https://github.com/dajobe/raptor/blob/raptor2_2_0_16/src/raptor_term.c#L200-L218", "tags": ["technical-description"]}, {"url": "https://github.com/dajobe/raptor/blob/raptor2_2_0_16/src/raptor_term.c#L270-L287", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Tag", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/raptor-rdf-syntax-library-2.0.15-through-2.0.16-heap-buffer-overflow-via-language-tag"}], "credits": [{"lang": "en", "value": "Pedro Ribeiro (@pedrib1337) from Agile Information Security", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/dajobe/raptor/issues/83", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-20T16:41:11.096426Z", "id": "CVE-2025-71436", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T16:41:49.461Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-71436", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-20T16:41:11.096426Z"}}}], "references": [{"url": "https://github.com/dajobe/raptor/issues/83", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T16:41:22.717Z"}}], "cna": {"title": "Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Tag", "credits": [{"lang": "en", "type": "finder", "value": "Pedro Ribeiro (@pedrib1337) from Agile Information Security"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"repo": "https://github.com/dajobe/raptor", "vendor": "librdf", "product": "Raptor RDF Syntax Library", "versions": [{"status": "affected", "version": "2.0.15", "versionType": "semver", "lessThanOrEqual": "2.0.16"}], "packageURL": "pkg:github/dajobe/raptor", "defaultStatus": "unaffected"}], "datePublic": "2025-10-18T08:56:39.000Z", "references": [{"url": "https://github.com/dajobe/raptor/issues/83", "tags": ["issue-tracking"]}, {"url": "https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575", "tags": ["patch"]}, {"url": "https://github.com/dajobe/raptor/blob/raptor2_2_0_16/src/raptor_term.c#L200-L218", "tags": ["technical-description"]}, {"url": "https://github.com/dajobe/raptor/blob/raptor2_2_0_16/src/raptor_term.c#L270-L287", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/raptor-rdf-syntax-library-2.0.15-through-2.0.16-heap-buffer-overflow-via-language-tag", "name": "VulnCheck Advisory: Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Tag", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "Heap-based Buffer Overflow"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:librdf:raptor_rdf_syntax_library:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "2.0.16", "versionStartIncluding": "2.0.15"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-20T15:40:22.461Z"}}}, "cveMetadata": {"cveId": "CVE-2025-71436", "state": "PUBLISHED", "dateUpdated": "2026-10-20T16:41:49.461Z", "dateReserved": "2026-10-20T14:50:46.229Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-20T15:40:22.461Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/dajobe/raptor", "product": "Raptor RDF Syntax Library", "repo": "https://github.com/dajobe/raptor", "vendor": "librdf", "versions": [{"lessThanOrEqual": "2.0.16", "status": "affected", "version": "2.0.15", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code."}, {"lang": "es", "value": "Biblioteca Raptor RDF Syntax desde la versi\u00f3n 2.0.15 hasta la versi\u00f3n 2.0.16 contiene una vulnerabilidad de desbordamiento de b\u00fafer basado en mont\u00edculo en raptor_new_term_from_counted_literal() causada por truncar la longitud de la etiqueta de idioma a un unsigned char. Los atacantes pueden suministrar documentos Turtle, TriG, N-Triples o N-Quads con etiquetas de idioma de 256?bytes o m\u00e1s para corromper la memoria del mont\u00edculo, provocar fallos en las aplicaciones y, posiblemente, ejecutar c\u00f3digo."}], "id": "CVE-2025-71436", "lastModified": "2026-10-28T14:10:00.220", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-71436", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-20T16:41:11.096426Z", "version": "2.0.3"}}]}, "published": "2026-10-20T16:16:59.067", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/dajobe/raptor/blob/raptor2_2_0_16/src/raptor_term.c#L200-L218"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/dajobe/raptor/blob/raptor2_2_0_16/src/raptor_term.c#L270-L287"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/dajobe/raptor/issues/83"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/raptor-rdf-syntax-library-2.0.15-through-2.0.16-heap-buffer-overflow-via-language-tag"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/dajobe/raptor/issues/83"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "raptor2: raptor2: arbitrary code execution via heap-based buffer overflow in language tag handling", "id": "2556277", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556277"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in raptor2. The library improperly handles language tag lengths when parsing RDF (Resource Description Framework) documents, truncating lengths that exceed 255 bytes. A remote attacker can exploit this vulnerability by supplying a specially crafted document with an overly long language tag to trigger a heap-based buffer overflow. This flaw may allow an attacker to execute arbitrary code or crash the application, causing a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\nThe highest-value action is to enforce strict length validation on language tags in raptor2 literal constructors to prevent integer truncation and heap buffer overflows: upgrade to the fixed Raptor builds, which bounds language tag iteration by explicit length and validates language tag length limits up to 255 bytes, closing all 4 injection vectors (crafted Turtle document containing a language tag >= 256 bytes, crafted TriG document containing an oversized language tag, crafted N-Triples document containing an oversized language tag, crafted N-Quads document containing an oversized language tag). Until patched, this is a concern on Applications and automated ingestion services on any platform that use raptor2 to parse RDF data, so Restrict ingestion of untrusted RDF documents in automated processing pipelines and pre-filter input documents to reject language tags exceeding 255 bytes before passing them to raptor2. As a compensating measure, enable Address Space Layout Randomization to randomize application memory layout and hinder reliable control-flow redirection following heap corruption, compile parsing binaries with full RELRO and PIE to protect the Global Offset Table and randomize base addresses against heap overwrites, enforce Control Flow Integrity or Shadow Call Stack to validate indirect function call targets if heap corruption modifies function pointers, deploy EDR monitoring to detect anomalous process behavior and payload execution if heap exploitation occurs, deploy Falco or eBPF runtime security to alert on anomalous system calls and unexpected processes spawned by RDF parsing services, and enable NX/XD bit memory protection to maintain non-executable permissions on heap pages where oversized language tags are stored. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer-truncation heap buffer overflow defect \u2014 apply the upstream patch to fully remediate.\nHighest-impact CME: CME-101 ASLR (Address Space Layout Randomization) (medium)"}, "name": "CVE-2025-71436", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "raptor2", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "raptor2", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "raptor2", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-10-20T15:40:22Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-71436\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-71436\nhttps://github.com/dajobe/raptor/blob/raptor2_2_0_16/src/raptor_term.c#L200-L218\nhttps://github.com/dajobe/raptor/blob/raptor2_2_0_16/src/raptor_term.c#L270-L287\nhttps://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575\nhttps://github.com/dajobe/raptor/issues/83\nhttps://www.vulncheck.com/advisories/raptor-rdf-syntax-library-2.0.15-through-2.0.16-heap-buffer-overflow-via-language-tag"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.15,2.0.16]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Raptor RDF Syntax Library", "source": "cna", "vendor": "librdf"}, "product": "raptor_rdf_syntax_library", "vendor": "librdf"}], "created": "2026-10-20T17:00:18.300104+00:00", "updated": "2026-10-22T20:30:12.897610+00:00", "vendors": ["librdf", "librdf$PRODUCT$raptor_rdf_syntax_library"]}