CVE-2025-71436
Received Received - Intake

Heap-based Buffer Overflow in Raptor RDF Syntax Library

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulnCheck

Description
Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2025-71436
EUVD
EUVD-2025-211138

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
librdf Raptor RDF Syntax Library 2.0.15

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2025-71436 is a heap-based buffer overflow in the Raptor RDF Syntax Library affecting versions 2.0.15 through 2.0.16. The vulnerability occurs in the function raptor_new_term_from_counted_literal() due to incorrect truncation of language tag lengths to an unsigned char. Attackers can exploit this by providing maliciously crafted Turtle, TriG, N-Triples, or N-Quads documents with language tags 256 bytes or longer, causing heap memory corruption, application crashes, or potential arbitrary code execution.

Detection Guidance

To detect this vulnerability, inspect applications using Raptor RDF Syntax Library versions 2.0.15 or 2.0.16. Check for crashes or memory corruption when parsing Turtle, TriG, N-Triples, or N-Quads documents with language tags longer than 255 bytes. Use tools like fuzzers to generate test cases with oversized language tags and monitor for heap overflows or crashes.

Impact Analysis

This vulnerability can lead to program crashes, denial-of-service conditions, or arbitrary code execution if exploited. Applications parsing RDF data using vulnerable Raptor library versions may become unstable or compromised. Memory corruption issues like double frees, null dereferences, and invalid memory accesses can also occur, further destabilizing systems.

Mitigation Strategies

Upgrade Raptor RDF Syntax Library to a version beyond 2.0.16 where the vulnerability is fixed. If upgrading is not possible, restrict input to trusted sources and validate language tag lengths to ensure they do not exceed 255 bytes. Monitor applications for crashes or memory corruption.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-71436. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart