Nokogiri versions earlier than 1.13.5 contain an integer overflow in libxml2 buffer handling, allowing attackers to craft oversized XML documents that trigger out-of-bounds writes on the heap. The overflow can lead to information disclosure, arbitrary data modification, or a denial of service by corrupting memory. This directly compromises the confidentiality, integrity, and availability of systems parsing untrusted XML.

The affected product is Nokogiri, distributed by sparklemotion under the name Nokogiri. All releases before version 1.13.5 are vulnerable; versions 1.13.5 and later include the library patch and are not affected.

The CVSS score of 8.8 indicates a high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by sending specially crafted multi‑gigabyte XML files to an application that parses them. Based on the description, the likely attack vector is remote via network or local input to the XML parser. The exploit would require sufficient privileges to run the vulnerable application and memory to craft the large XML inputs.