CVE-2025-71436

HighCVSS 7.1/10Last modified Oct 28, 2026

Description

Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-122

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
librdf	Raptor RDF Syntax Library	>= 2.0.15, <= 2.0.16

References

Timeline

Published: Oct 20, 2026
Last modified: Oct 28, 2026
NVD status: Awaiting Analysis

Related CVEs from 2025

CVE-2025-714376.5Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafte CVE-2025-714385.5An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denia CVE-2025-714395.5llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llama_vocab::impl::print_info() that allows attackers to crash mo CVE-2025-71444.8A vulnerability has been found in SourceCodester Best Salon Management System 1.0 and classified as problematic. This vulnerability affects CVE-2025-71457.2ThreatSonar Anti-Ransomware developed by TeamT5 has an OS Command Injection vulnerability, allowing remote attackers with product platform i CVE-2025-714503.3inih before r63 contains a one-byte stack buffer under-read in ini_parse_stream() in ini.c that allows attackers to read abyss[-1] via an em CVE-2025-714516.1Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/serverside/serverbackupprog CVE-2025-714526.1Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/restoreprogress.CVE-2025-714536.1vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitiz CVE-2025-714546.5vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrf_check() in include/utils/VteCsrf.php skips __csr CVE-2025-714555.3vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by CVE-2025-714568.1vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a c