Vulnerability details

CVE-2025-71436

librdf Raptor RDF Syntax Library

Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Tag

CVSS 4.0

7.1High

Official description

Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code.

CVSS scores

Score	Version	Source	Vector
7.1High	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N`
7.1High	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H`

Affected products

Vendor	Product	Versions	Source
librdf	Raptor RDF Syntax Library	2.0.15 ≤ v ≤ 2.0.16	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575 patch
https://github.com/dajobe/raptor/blob/raptor2_2_0_16/src/raptor_term.c#L200-L218 technical-description
https://github.com/dajobe/raptor/blob/raptor2_2_0_16/src/raptor_term.c#L270-L287 technical-description
https://www.vulncheck.com/advisories/raptor-rdf-syntax-library-2.0.15-through-2.0.16-heap-buffer-overflow-via-language-tag third-party-advisory
https://github.com/dajobe/raptor/issues/83 issue-tracking

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-10-20
Last updated: 2026-10-20
State: Published
Assigner (CNA): VulnCheck

Exploit prediction (EPSS)

0.49%

Probability of exploitation in 30 days

42.8%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Partial

Weaknesses (CWE)

CWE-122
Heap-based Buffer Overflow