Nokogiri versions prior to 1.18.8 include a vulnerable copy of libxml2 (before 2.13.8) that has a heap‑based buffer under‑read in the xmlSchemaIDCFillNodeTables function within xmlschemas.c. The flaw can be exercised when validating against an untrusted XML Schema, or when validating untrusted documents against trusted schemas that use xsd:keyref together with recursively defined types that also contain identity constraints. The under‑read is classified as CWE‑125 and is deemed low severity by upstream sources and MITRE.

The vendor is Sparklemotion and the product is the Nokogiri Ruby library. All releases before version 1.18.8 are affected because they bundle libxml2 versions older than 2.13.8. No further sub‑version detail is provided, so any installation of Nokogiri that has not been updated to 1.18.8 or later is exposed.

The CVSS score of 8.7 indicates High severity, and no EPSS score is available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to supply or influence an XML Schema or document to the application. An attacker could trigger the under‑read to read unintended memory regions, potentially revealing sensitive data or facilitating further attacks. Because the flaw is in a continuously processing library, the risk is local to systems that ingest XML content through Nokogiri and can be mitigated through patching.