CVE-2025-71436

Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/dajobe/raptor/blob/raptor2_2_0_16/src/raptor_term.c#L200-L218
https://github.com/dajobe/raptor/blob/raptor2_2_0_16/src/raptor_term.c#L270-L287
https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575
https://github.com/dajobe/raptor/issues/83
https://www.vulncheck.com/advisories/raptor-rdf-syntax-library-2.0.15-through-2.0.16-heap-buffer-overflow-via-language-tag
https://github.com/dajobe/raptor/issues/83

Configurations

No configuration.

History

28 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) Biblioteca Raptor RDF Syntax desde la versión 2.0.15 hasta la versión 2.0.16 contiene una vulnerabilidad de desbordamiento de búfer basado en montículo en raptor_new_term_from_counted_literal() causada por truncar la longitud de la etiqueta de idioma a un unsigned char. Los atacantes pueden suministrar documentos Turtle, TriG, N-Triples o N-Quads con etiquetas de idioma de 256?bytes o más para corromper la memoria del montículo, provocar fallos en las aplicaciones y, posiblemente, ejecutar código.

20 Oct 2026, 17:17

Type	Values Removed	Values Added
References	~~() https://github.com/dajobe/raptor/issues/83 -~~	() https://github.com/dajobe/raptor/issues/83 -

20 Oct 2026, 16:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-20 16:16

Updated : 2026-10-28 14:10

NVD link : CVE-2025-71436

Mitre link : CVE-2025-71436

CVE.ORG link : CVE-2025-71436

JSON object : View

Products Affected

No product.

CWE

CWE-122

Heap-based Buffer Overflow

{"id": "CVE-2025-71436", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-71436", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-20T16:41:11.096426Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/dajobe/raptor", "vendor": "librdf", "product": "Raptor RDF Syntax Library", "versions": [{"status": "affected", "version": "2.0.15", "versionType": "semver", "lessThanOrEqual": "2.0.16"}], "packageURL": "pkg:github/dajobe/raptor", "defaultStatus": "unaffected"}]}], "published": "2026-10-20T16:16:59.067", "references": [{"url": "https://github.com/dajobe/raptor/blob/raptor2_2_0_16/src/raptor_term.c#L200-L218", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/dajobe/raptor/blob/raptor2_2_0_16/src/raptor_term.c#L270-L287", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/dajobe/raptor/issues/83", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/raptor-rdf-syntax-library-2.0.15-through-2.0.16-heap-buffer-overflow-via-language-tag", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/dajobe/raptor/issues/83", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-122"}]}], "descriptions": [{"lang": "en", "value": "Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code."}, {"lang": "es", "value": "Biblioteca Raptor RDF Syntax desde la versi\u00f3n 2.0.15 hasta la versi\u00f3n 2.0.16 contiene una vulnerabilidad de desbordamiento de b\u00fafer basado en mont\u00edculo en raptor_new_term_from_counted_literal() causada por truncar la longitud de la etiqueta de idioma a un unsigned char. Los atacantes pueden suministrar documentos Turtle, TriG, N-Triples o N-Quads con etiquetas de idioma de 256?bytes o m\u00e1s para corromper la memoria del mont\u00edculo, provocar fallos en las aplicaciones y, posiblemente, ejecutar c\u00f3digo."}], "lastModified": "2026-10-28T14:10:00.220", "sourceIdentifier": "disclosure@vulncheck.com"}